Lucene search

K
openbugbountyDkilerS2OBB:1151100
HistoryApr 27, 2020 - 12:47 p.m.

imovirtual.com Cross Site Scripting vulnerability

2020-04-2712:47:00
DkilerS2
www.openbugbounty.org
6

Open Bug Bounty ID: OBB-1151100

Security Researcher DkilerS2 Helped patch 112 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 8 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affectingimovirtual.com
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: imovirtual.com
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **DkilerS2 Helped patch 112 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 8 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAYsUlEQVR4nO2df0xbxx3AX4kBQwxxjO0Q4ySGZjRCGU0rapGOZghFEXMt6jJKUsoopVFLI0YooillU8YSRll+VBlFCFW0Sqtqy6oKMRRlVsSiiiKW0Yw5HmUOpYi4ruMRQoC6riGEtz9OO72+++FnYxNo7vOX73w/vr/8zj6/+74HeJ7nGAwGg8GIAFH3WgAGg8Fg/GBhawyDwWAwIgVbYxgMBoMRKdgaw2AwGIxIwdYYBoPBYEQKtsYwGAwGI1Ks3jUmNTX16tWrpCJjVbFWvLNW5GSEHeb6e8UqXWP+/e9/Ly0tPfzww9giY1WxVryzVuRkhB3m+ntIgDXm+vXrCQkJ2LdmZ2fffPNNUnGZ9PT0FBQUkIorAEXxSA++HEtGVGwSK+8dSFD6hiYn3R0rYPB74lNuGXEoFPj69esP/J/o6Ogf//jHf/7zn2HLmzdvPvfcc0lJSSkpKa+++ur8/Dxd2bfffvvBBx+MjY195JFH/vrXv2JnxAJdf/v27RdeeEGj0aSkpLz++ut37twJQUFGcPBUJiYmFAqFlLcoLUPAaDRevHiRVFwZ/H7/PRl8OZYMrxckck+8A5HuptDkDGjSiMbJik2BEnIsCTuC136/3+/3T05Onjt3Tq1Wnz9/Hrybn59fUVHhdrvHxsby8vLq6uook7a2thoMhkuXLoFxVCpVX1+fRFGh6wsKCkpKSlwul8PhyMnJqa+vD0FBRlCsxjXG7XYrlcqFhQVs8QfP2lpj1op3Qpbznizbq4EwrjHCdzs6OkwmE8/zXq9XLpd7vV5QPzg4uH37dsqkOp3u0qVLsHjmzJmCggIpokLX+3w+vV4vmjEEBRlBIen/mD/84Q+pqalJSUm/+MUvZmdnOY6bnZ01GAxer/eBBx54//33hcW33norISHh5MmTmzZt2rhx4/PPP//dd9+BcT777LMnnngiISEhJSXl5z//+X/+8x/sdD09Pfv27YuOjhYVn3766ZMnT4LKq1evxsbGAmE4jnv55Zdfe+01eoMf/ehH9O5CGeCvb/Di9OnTqamp69ev379//61bt1577TWNRpOUlPTCCy98++23oMu333778ssvazSaLVu2/Pa3v7179y7Hcfv37//d734Hh929e/f7778vGvzNN9/UaDSbN29+9913RYYVbQJcv35948aN0Ji7d++Oi4vTaDTPPPPM119/TXfi3bt333jjjU2bNq1fv/6ZZ565desWSWzpKoucRRLpxo0bTz75ZEJCQmpq6unTp6EK8/PzL774YkJCwrZt237zm98Aiwln37hx43PPPQfdhKogsg/FJlBO0IUUn6LuWHcI/SXaF1pOqJAUF+mI7Svd4xSbU+IwqHnpGI3G4eFhjuPWr1//3XffrV+/HtQvLCzExMQIW37++edJSUmffvopx3Gzs7NutzsnJwe+u2fPHjCOCGEvAHR9XFzcV199BWccGxvT6XQc4bqENRRHiDHUgCT734cEXmO8Xq/NZhsYGBgcHHS73fX19RzHbdiwweFwgF/BpaWlwuLTTz/t9XoHBwevXLly5cqVoaGhEydOgKHMZnN5ebnT6ezv78/JyZHL5dgZSX/GmM3m3t5eUHn+/PmlpSWr1QqKvb29JpOJ3sBisdC70y3Q399vs9ncbveOHTumpqbsdvvly5cnJiYaGhpAs+rqarfbPTQ0ZLVae3p62tvbOY4rLi7u7u4GDW7cuGGz2SwWi2hwh8MxPDx89uzZnJwckWEpfhkaGnrppZc8Hs/w8LBer6+qqqI05jjuxIkTvb29vb29o6OjOp1uZGSEIrZElbnvO4skUlVVVUxMzNjYWG9v7wcffAD7Hjt2zOfz2e12q9Xa19fX0dEBbWK320HIOZ1OOB1JBSk2EcpJik+0O+oOkb9EAiwnVCiKCyH1lehxis3pcSh9XjoqlWpubg6tb2pqKisrg8XZ2dnCwsKWlpYnnngCiCeXy+H3To7jEhMT0XFEvQDY/+GuXbtWV1d36tQpjnBdIhmKFGNoYAQM1/sF+s+ciYkJjuPm5uZAcWBgIC0tDb6F3SsDXZxOJ6jv6urKysrieX56elomk2F3lp1Op8FgAK+9Xq9CoZienkaLbrc7Pj4ejGA0Gmtra0tKSsCMiYmJCwsL9AZOp5PeXaS4UJ2ZmRlQ39/fHxUV5fP5oEHAz+3FxUWFQjE+Pg7qe3p6srOzeZ73+Xxgap7n29vbwa970eBQWdSwqJGVSiVqwLGxseTkZLS9EK1WOzQ0JKrEii1RZdRZWJEWFxflcjmcoqurC6qgVqvhxoXNZjMajTwScv39/TDkUBUo+kIBRHKS4pPUXeQOkb/Qd0MOFZLiwilIfbFgPU6xOSUOg5qXvleGjeHGxsa9e/cuLi7C9iaT6dChQ9gxAePj4yqVSvSuqBdPCFGXy5WWlnbu3DmefF3CGkqEMEhQA2Ltfx8iC7gIKRQK+FNdp9NNT08H7CKXy7ds2QJe79ixw+l0chy3cePGoqKi7OzsvLw8nU6XlZX105/+FA47MDAAXl+8eNFoNMLtFGFx8+bN6enpAwMDGRkZbrf76NGj6enpd+/e7e3t3bt3b3R0NL3Bli1b6N0pFtiwYQN4rdfrExMT4+LioORTU1Mcx01OTi4sLKSmpkKtQdjFxcWZTKbu7u5f/vKXXV1d5eXl6OBQ2aD417/+deTIkZGRkYWFhaWlpaWlJUrj2dnZ6enpzMxMUT1JbCkqc4izsCJNTk4uLS0JpwAvbt++PTU1ZTAYQHFpaUkmk0GbwJDT6/Ug5EgqSLGJSE5sfEo0Kd1fywkVkuJCSH01Gg1sc/PmTZK56Dan6CV93hD4y1/+8sEHHwwODq5btw7U/OpXv7JarZ2dnbCNTCZbXFwU9hIKT+rFIa4HFBUV1dTU7N+/nyNclyiGIgWJyIBSwvU+IfAaE0b+9Kc//fOf/xweHna73bW1tY8//vjbb7/Ncdy6des2b94M2tDvWjaZTL29vePj42azecOGDbt27err6xPudNEbBOweCYqLi9va2kpLSwcHB7u6usI1rMViOXjwYEdHh1wud7lc+fn5AbvAz3C4EHknKJH8fn9UVNSVK1fgpzcqKvDOLV0FkgAS71oOwaSrBJvNhq0XmSs0m4cwL4Xp6enExERY/PzzzysrK61Wa1JSEqjx+XxdXV3nzp2rqqoqLCwEazbYtbtz5050dPTs7Ozly5eVSqVCoYDjYHtxONffuHHDbrf//e9/hzXodamhoYFkqKCCJOyfuDUJ/WcOZa9G4l5Zd3c3di/CZrPp9XpR5eLiolqthj/JRUWe5wcGBoxGY0FBwYULF3ieb29vr66uTk5OdrvdUhoE7I5Vh7JbBYuUzQS/369Sqc6cOVNYWEgfHDXs3NxcVFSUcP8ETDc5OSmTyYTGBPX0vTKbzYYaHLtXJlFloXdIIoG9somJCVAv3CtTKBToZgJldlQFYWOKAEI5SfEpxaTYnR+JG5sBQ4XUfTl7ZajHpdgcrQzjXhm8r4zn+enp6e3bt//xj38U9pXJZCMjIzzPm83mqqoq+JZOp/vkk09AG4PBYDKZ4DikXugFBFSKaoTA6xLWUEF97rD2vw8JfY3xer0ymWx0dFRUBJ/hoqIil8s1PDy8a9euxsZGnudHRkby8/MvXbo0NTXldDoPHjxoNpvhyGA/tK+vb+fOnbBSVARotVqtVgvau1yuxMTEXbt2SW9Afxduywa7xvA8f/DgwYKCAqfTOTw8/Oijj7a2tsJmJSUliYmJH330EX1wrGGNRuPBgwc9Hs/o6GhOTo7wgtve3j4zMzM6OmqxWED93NycTCZzOByLi4v8989VNDc3G41Gu93ucrmqqqrg2QJUbIkqo97BisTzfFFRkcVimZiYGB4ezszMhPWVlZXZ2dng++OJEyeOHTtGNziqgqgxVgCRnKT4JHUXuiMsawzW5pTuonpKmInAelyKzQGiOJQ+L+l8zNTUlPB8zOLi4t69e6urq/0ChH0dDodcLrfb7aDY2tqalpYGLiBHjx7lOK6trQ2dUdgLewHhv/+5IF2XsIbiCUGCNSDpE3e/Efoaw/N8Y2NjfHz82bNnhcXTp08rFIqWlhatVqtUKsvKysDfngsLC42Njenp6TExMVqttrS01OPxiGapq6traGiA44uKgJKSkqKiIljMysoStaE3oLyLvV5Iv3B4vd6XXnpJrVbr9frGxkZwlQd0d3crFAr49y99jREZFhxPUygUGRkZra2tcLq+vr6srCy5XJ6cnFxbWwvr6+vrQV/R4IuLi0eOHFGr1XK53GKxTE1NkcSWqDLqHZJIHo/HbDYrFAqDwdDS0gLr/X5/TU2NXq+Pj483mUzg2yVldlQFUWOsACI5QRc0PinyQ3eEa43BhorENYYSZiKwHpdic4gwDqXPi94HAZDJZBkZGeCfdtFbAKVSKZKkurp6z549sAiWGblcnpWV9dZbb+l0urGxMVR+2At7ARH5hXRdwhqKJwQJ1oCkT9z9RoA1JgQo2zUBSU9Pv3z5MqnIWFWE5h2Hw6HVaiMhDwmRnMuJT8aqIuBdW+wCshpY0f/8A3Lt2jVKkbGqCM07NpstLS0t7MJQYFH0Q+WRRx6hN2CuXw2EeFfJV199pdFoNBrN8ePHwyvQ6uSpp57SaDTw3k1GUBw/fvzdd9+9efPmP/7xj4aGhsrKytDGCSo9+1rM5X716tVXXnmF0uDOnTvPPvvsf//7X4kDriojSBdmVYnNWCYhrjFLS0s+n89ms9XU1IRXoNVJZ2fn+fPn4bkQRlDk5ua2t7fr9frS0tLq6urnn38+hEGCSs++RnO5l5eXwzMZWKKjo2NiYurq6qSMtqqMIF2YVSU2Y/mEnts/KioqJSUFfXfbtm3ffPMNZczwPgVg+VB0hPnBNBpNcnKylNHm5+efffZZ0YDXrl372c9+tmHDhk2bNr344osgDxW2UpgLHZCamirMbwbkCS3fe8hZ4r/55pvDhw9v27YtLi7uoYce+v3vfx9UuqqtW7eOjo7Oz89/8cUXhw8fJjWjBwY86IBqcfLkyQcffPD27dtoY5SA8RkUr776alxcHMjRt8yhbt26Zbfb4Zc2bHhwHFdTUwNTItGBRlim+6SETcAPtXT33cNHRTAiwT14RtnMzExzc/PKz0ti27Zt4fqBMj8/n5+fLzqQzHGcyWTS6/UOh2NoaMjv94PNImwl9//jZoCmpqbVcFS4oqLC6XRevHjR6XS2t7dbrdahoSHp3SVamB4YpEvP3/72t6ampu7ubuEp65W5Tt26dau1tfXy5cuHDx9efgh5vd74+PjY2FhQJIWHSqXyer1SBoRGWAH3BfxQS3cfW2N+aNBvCSDdhLOcm3PW0I09lDOnpPZNTU2iln6//8yZM/Acpd1u1+v12Eqe5z0eT35+PuybkZHR1dXlcrkeffRRnuddLhfImwRrglUnBMv7fD6ZTAbTcEUOinjCzPzCZk6nU61WCw/x8Sv4uIHwRrJwNFJ4SJ9UmNB+BdxHl0q6+9bKoyIY0pG0xpw5c8ZgMKhUqtLSUhCs6NmL+vp6rVYbHx9fVFQE7wQfHBzMzs6Wy+VqtRqcepuZmYHLG7jv3u/3V1RUKBSKrVu3Hj16FN5373a7TSYTOFRx6tQpKWcLmpub1Wp1cnJyZ2dnW1vbvn37oIQNDQ1lZWUUHWHR5XLt27dPoVCkp6c3NzcHtcYEbLmwsHDkyBGRJNhKYD21Wh3Gz5tIMKvVSm8PGoCzeDA/oAjU9agv0EMkJ06cEB1PQQNDSEdHR3FxsUgLv9+flZVVU1NDaYzVkRSupKNCp06dMhgMSqWypKQEXqyFX+3BmTCheKj6YJD4+Pji4uKpqam6ujq1Wq1SqcrLy4FtSWEjCg9SM5Gm0AgU92HtQHFfaL7jg3GfsCWqFGMtIinvcnl5OXxWXWVlJY8EenNzc1ZWFjjRWl1dDU+0dnR0vPfeezMzMx6Pp6amxmKx8DwPc4aD5aGhoeHAgQPj4+MjIyO5ubnw7G5hYaHFYvF4PGNjY8LD4RUVFWazGT0jzXFcWVmZx+OxWq0Oh8PlcsnlcvhNcOfOnd3d3SQdhbpYLJaioiKn0zk2NrZz507SGqNGIA0I6erqkslkubm5wmPG2ErAoUOHqqurCZ4JBZFgycnJeXl5V65cQVsODg7m5eXBvMUFBQVms7m/vx+9VKGuR32BHsoTWhgesxcFhhCTyfThhx+KtKioqOA4zuFwUBpjdSSFKxpaUBe32w3yLAjT+kKBx8fHRQqK1Oc4rrS01OVygUHUajX4TI2Ojubm5gIvY8MGDQ+0mchZqBFI7sPageK+0HwXlPuELUnuY6wtQsztj+bwCHgeipR/HptDm5QQnp4XXZRbOzs7++OPP4Yzkh5YK5QHzCtM/E5aY1wI2AGF+Hw+kNyio6ODXsnzvN/vVyqV4c0Njp4Yb25uVqlUxcXFMGXI6OhocXGxSqVqbm6Gfpmbm6uvr09PT5fJZNu3bxce88bm2+cCJcDHptYn2U2Unh006+joSE9PLykpgVngsI2xOgb7mAPsgwaEAqMKitTnJOT8x6qPhoewGdZZqBFI7sPageK+EHyHCkNxH5qHH+s+xtoixFwywvqZmRmQeRvtPjQ0tHfvXp1OB7YF0L4gezn8KaBSqcAhcLfbHRMTA8cZGRkBfUX1o6OjlOemtLS0lJeX8zzf1tYm/AFO0dHtdsvlcnRe0hQBB0S5cOEC+lcKWnnu3LnMzEwp0/Hf/1FFqiEJNj09bbFYYKY/mUxmsVhI2/d+v39gYCA7O/vXv/41T3B9wIQrIgvDY/+U3395eXnC0WQymVardTgcHo9HoVCAVInYxqiOpHDFhlbA9DDYNYaiPnaQgPlMheEhbEZyFtYI/PfdR7IDRf4QfIcKQ3EfSWxRiDLWFmG7rwybxdpisezZs6evr89ms124cAFtAJON22w2m81mt9tDyBZOorCwEEx6/vz5wsLCcA0L0CCQWt65c+ezzz6DxbS0NLfbja0U9jp79izYTJCCTQCpBsuXX34JsvUdO3YM1Bw7dqyvr+/QoUNffvkl2j42Nnb37t2tra0fffQRrIx0AnP0RqOlpaXOzs6HHnpo06ZNR44cqa2tpTRGdVwBmZdJwPAAkJxFujULdd8K2EG6+7BiY93HWEvQlyCJefqwWawl5sFW4HJokxLCS8yLDtm5c2dvb69SqYTbHXQdRXtl3d3dy98r8/v9MpkM7gD09PQYjUZspXBwuVw+OTlJkjksVFZWKhSK2tpaUba+qampmpoahUIB/nvjeV60j9/X1yd8NiUl3z5aM0F+9AMpsaAoPbuomc/n0+v1nZ2d2MZYHcP4mIMI/Y6hhIdoNNRZqBFI7sPagf47JijfYYUhuQ+bh58Uoow1RHjWGFIW64DJ0nlyDm1SQngpedEhR48ezczMFD5EIKCO4D9/mPg9LHtlZrP5wIEDLpfLZrNlZGS0t7eTKgEtLS3g/oiwI/xTqrS0FK7iKBMTE6Wlpfz/s1i+8847brd7ZmYG/D3Q3NwMmgXMt8/j1hhsan1RYADQ9Ozo+O+9915ycvLc3BzaGKtjGB9zEMY1xul0CneiSOExNjaGPqsYOgu1GMV9WDsEXGOk+w4VBjs+cJ/VakXz8NNDlLEmCM8aQ8piHTBZOk/OoU1KCC8lLzoE7BRh76ck6Si8d1l4z/Ry1pjJyckDBw4olUq9Xt/U1ESpBOzYsYN0F9xykK6CiAsXLuTm5iYmJsbHx2dmZr7zzjvwrYD59nncJRibWp9HnhbB49KzY7XYtWtXfX09Npc7ShgfcxDGNcbv98vlcniZJoXHxx9/TP+jDjUCyX1YO9DXmKB8hxWG5D6j0SjFd4w1R4i5/cE3GrVaDX92RJSQE8J7vV65XC663ywECgoKVCpVaBdohpBg17mg0rOv9Vzu1dXV2D+9IX6/32AwgI1BEpEzQgjfUaQLs9Z9xyARYm5/vV7vcrk4jhM+mjtyhJwQ/uLFizk5OcIsI6HR2dm5sLCwzIefM0IgqPTsaz2X+6lTp+j3aMTGxn744Yc/+clPKG1WlRGkC7OqxGaEkRDXmHXr1qWkpIRXFBHHjx/X6XQFBQXj4+MNDQ3g6apBMTs729bWduDAAVAk3fo1Pj4eMOUf5bYxBiNcREdHP/bYY/Q29AWGwVhtrK5nlAnJzc2tqak5dOjQ1q1bQ0sIr9VqzWZzWVkZKJK+IS4/Yy6DwWAwsDzA8/y9loHBYDAYP0zYHwwMBoPBiBRsjWEwGAxGpGBrDIPBYDAiBVtjGAwGgxEp2BrDYDAYjEjB1hgGg8FgRAq2xjAYDAYjUrA1hsFgMBiRgq0xDAaDwYgUbI1hMBgMRqRgawyDwWAwIgVbYxgMBoMRKdgaw2AwGIxIwdYYBoPBYEQKtsYwGAwGI1L8D2c4XJRmkL63AAAAAElFTkSuQmCC)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAVGUlEQVR4nO2df0xT19vAr1ihYsVa2oLAECpBYxxD4wxzbjFKDCPMdcQxRMLQEYeEISPMISGEIUHG0C9RQ4jDhS2LY4thhDjHDDFLReZQm1orqZ26irUyRASt7AqV+/5x3p1c76/elhaRPZ+/ek+fc85znufc+/See+7TWRRFEQAAAADgA/yetwIAAADAjAViDAAAAOArIMYAAAAAvgJiDAAAAOArIMYAAAAAvgJiDAAAAOArXvgYEx0dffny5eetBfAcmM6uv337tkqlUqlU+/bte966TAXvvPOOSqWKjo5+3ooA0w7J81ZgUly5cmViYuKVV1553ooAU800d/3ExMTo6KjFYgkKCnreukwFTU1NN2/eTExMfN6KANOO6Xgfc+vWrfnz54uRbG9v37x5swddjIyM7N+/f5K9e8wUdMGJwKiFoSt869atWf8yZ86cl19++YcffsCS9+7d27ZtW3BwcHh4+CeffPLkyRPhwR4+fHjJkiUBAQErV6785ZdfOHvkBLv+wYMH27dvV6lU4eHhn3322fj4uAcD9BgBPf38/MLDwz1ztMee8hF8w7x169bChQsJglCpVKGhoSJbe/LkydatW+kNXrt27a233lqwYEFISMiHH344MjIiUE6fgYjo6GisIVbJg7NsMifmo0ePdu/evXjx4rlz5y5duvSLL754+vSpZ03NMKZjjFm8ePHg4KAYSY9jzPDwcHV19SR795gp6IITgVG7hUwmI0mSJEm73V5WVpafn//zzz+jr7KysqRSqclk0ul0RqOxrKxMoJ3Dhw8fPHiwqanJZrOVlJRkZmaePXtWpA7Y9dnZ2WNjYwaD4cyZM93d3eXl5ZMc3XTAW57yFl6csU+ePElKSnI6nfTC5OTkiIgIs9ms1+tJkszNzRUuxzOQJMmqqqq4uDiv6DYZduzY0dfXd/r06b6+voaGho6ODr1e/7yVmh5QLyx2u10ul4+NjXlQ12q1ymQyr6s0zfF41PSK7EYaGxuTk5MpinI4HFKp1OFwoPKenp6YmBiBTsPCws6cOYMP6+vrN2/eLEZV7PrR0dGIiAhGjx4M0GP49JzkBHtR5qfVapXL5fizGJ2tVmtVVRVdmCTJ+vr6hw8fokOj0RgRESFQ3t/fn5SUhBtcvnx5a2urzWZbtWoVRVE2m23NmjXoAypxaziemX10dFQikQwPD3tQd8bjOsb09PQkJCRIpVKlUrllyxabzUZRlN1uT05OlslkUVFRdXV1eJ6RJLljxw6ZTBYZGVleXu50Oql/PVdXVxcVFSWXyzMyMrAznE5nSUmJWq0ODAzcsmXL4OAg9aynOXtHNDY2pqWlYfna2lq1Wi2Xy7OyskZHRwWqDw8P4xB74MABmUxWXV2tVCpDQ0ObmprY11OkeWBgYFpa2uDgYHFxsVKpVCgU2dnZ+OrmcDh27typVCojIiIqKiqEB86Yypx1OeE0l4DN6eOij7q5udmtfoVjjF6vj4yMZNfq6upavnw5Xd5kMikUCp1Oh71A/4mg1+s1Gg27F3othusZHD9+/M0336QoqqenZ926dTKZLCwsLDU1tbe3l89QFM8kYRuQ0/5IrL6+PioqSqFQZGZmcrqYz3cu5yfyFKfmfOegwFSkD+fIkSObNm3C6pWWlmZlZXG7/9nh2Gy2TZs2yWSy2NjY6upqd2OMsPDY2NiePXvYmvCV9/T0KJVKz35outSqo6NDWB4LOBwOiUSCrwYAHddrZXq9fufOnf39/SaTKSIiIj8/nyCI/Px8f3//69evd3Z2fvvtt1i4srJydHTUaDR2dHTodLrGxkZU7nA4jEZjd3d3T09PX19faWkpKq+tre3s7Ozs7LRYLGFhYb29vWJ6R9AXyhwOR09Pz8WLFy9evKjX62trawWqL1iwwGw2o9vtd9991+FwmM1mk8nU3Ny8bt06hgIOh8NgMHR1dRkMBrvdvmzZssHBQaPReP78eavVigdSUFBgt9v1en1HR0d7e3tDQ4PwwOnw1WXDaS4Bm9PHRR91ZmamW/0Ko1AoHj58yC6vqqrKysrChyMjI6mpqTU1NW+88QZSTyqVzpkzBwsEBQWx22HUQnCukV67dq24uLiuro4giJSUlOzs7L6+vq6urnXr1kmlUgFD8c0x9sTgtD+aIcjFdru9pKSE00qcdV3OT+QpTs35zkGBqUgfjlar1el0jx49wiZNTU3l1JxBfn5+UFBQb2/vqVOnjh8/ziemYuGy5Z9++ikwMLCnp+fo0aNiygmCaG5uzsjIoM8iL5Kdnb1x48ZLly6xv7pw4cLGjRuzs7PR4bx585KTk9PT08+dO/f48WNfKPMC41ZEun79emhoqNPplEqlN2/eRIWtra34t4xSqcTB3GAwoJtWq9VKEAS+5+3q6sI/V9VqtV6vZ/TC9xsH9Y4+OxwOmUw2NDSE2+/r68P6rF69Wrg67gLVRe2we0ff4ruurq4uPz8/fJPU3d2NVmacTqdMJsMGaW9vT0hIEBg4vQu+upxwmkvA5vRxTaZf4fsY+oIJpqKiIjEx0el0Yvnk5OS8vDzONhE3b95UKBSMbxm1qGddj7HZbBqNpqWlhaKooaEhiURCkiRDJU5DMcCThNOAbPszXNzd3c12MV9dvq7Z1dma852DwlORMZyEhIQTJ07g7tgWow8T6YP6pZ9rfPcxNhacDdIZHR3V6XQrVqxobGwUU06SpFwuF7aqW7AXGKqrqxUKRVpamsViQYUWiyUtLU2hUFRXV9NvXB4+fFhSUhIbGyuRSGJiYoQXBv5TuI4xer0+MTExLCwMLRDJ5XK73e7v748Fent70TwbGhoiCEL5LwqFQq1WUyzP4UvS8PCwRCJhe4Iuz+4dlbe2tm7YsAHLS6VSuj6oX4Hq9BjDvmLyXU8ZF1N8yDCIxWLB1ynO6vRyvrpKGugrTnOJtDl7OOL7FbYJ2ywURbW1tWk0GvrKZ2lpqZ+f39dff41lbDYb3WsURV2/fh07jq8W9azrMQkJCYcOHcKH6enp8fHxRUVFdXV1v/32m4ChKJ5Jwh4mp/3FuJivLl/XjOqcmvOdgyKnIqKmpiY7O5uiqCNHjnCuPbKHabfbGeead9fKKIo6deoU53MUdnlLS0tcXJzIHtkTm13CqdXQ0JBWq5VIJOhQIpFotVqBRy8kSXZ3dyckJJSVlYnUbWbj+v0YrVabk5PT2NgolUptNltSUhKfJEmSfn5+Fy9elEj+v1k/P9drcbNnz/agd5E7ysQrP90wGAyc5QxzeWZzD/oVYGhoiP4WyNWrV3Nzczs6OoKDg1HJ6Ohoa2trS0tLfn5+amrqggULiH+3Bo2Pj8+ZM2dkZOT8+fNyuVwmk+F2OGsRXK6/e/eu0Wj8/fffccn3339/6dIlk8lkt9uLiorWrl2LwhWnodyaJMLTVRh2XTFde93FmNTUVLQGePLkSbzs4y3Yi2P37t3jlBwfHzcYDK+++io61Gg0drtdoBzT3Ny8Y8cOkfqwJ7aYqX7jxo3y8nKdTldZWYlKKisr6+rq8vLyKisrlyxZwq4SEBDw2muvHTp0KDMz8z/yBq4LhEPQwMAADuAURRkMBrlcju6XrVYrKqTfL8tkMpdrX/SfvWq12mAw8Mlz9k5RlNPpVCqVeEGAsVbW1taG1sr4qlPevo8RWKBw+SPX3bUytrnE2Jxd6MW1MryvjKKooaGhmJiY48eP0+tKJBL01D0lJSU/Px9/FRYWhm4yrFZrVFRUcnIyboevFsP1uJBRQsdgMKD9SJyG4psknAZk21/kfQxnXTHzE8HWnO8cFDkVMStWrOjs7JTL5Xi5jxO+tbK2trbJr5WRJCmRSPA6Xnt7O1rG5CvH7Uul0oGBAQG1J0lubq5MJisqKkJ35JjBwcHCwkKZTJabm4sLGQ/8dTodfiLwH8f1WplarW5oaBgeHrZYLFqtFk2pLVu2aLVaq9VqMpni4uLwPMvNzU1ISEC/H2traysrKynBK3V1dfWaNWuMRqPNZsvPz0d7h+jynL2jxVl6gwRBoG05JpMpPj6+oqJCoDr17z4Qi8XilRhDUVROTs7mzZv7+vpMJtOqVavQuo3ICxBnXU44zSXG5oxRu9sv2ybo1YTBwcGWlhalUnny5EmKopxOZ2JiYkFBAUmDXtdsNkulUqPRiA4PHTqk0WjOnDkzODiI3ms5cuQIu0d6LYbrMfRnCb29vUlJSajZvr6+nJyclJQUPkNRPJOE04Bs+4uPMZy+czk/0SGn5nznoJipiCkvL4+Li0P2EYBeXavV0s81r6yVpaSkpKen22w2g8GwfPnyhoYG4XKKompqarRarcjuxEOfSJmZmTiKcw4hMzMTfTabzWq1+ujRo3a7fXh4GM3S6upqr6v3IuI6xuh0utWrV0ul0tDQ0KKiIjSl+vv7U1JS0L7Jmpoa+t7lwsLCiIiIwMDA5ORk9HtK4ErtdDr37NmjVCqlUqlWq2XvXebsvbi4uLS0lN6gTCarqalh713mrI6oqKgIDAxEe5fp4/UsxghsGGXLsx8tit+7zDaXGJszRj3Jvcv4JlgikSxfvhw9aWd8hZDL5QxNCgoK0PZiBAozUql09erVBw8eDAsLu379Olt/XIvherYjKIoaGxurqKiIjY319/dXq9WZmZn9/f18hqJ4JgmnAdn2Fx9jOH3ncn7ivctszfnOQTFTEYPWi1AvAtCr0/cu0/dMTybGDAwMpKeny+XyiIiIqqoql+UURS1btqytrU1kd55p5RanTp1av359UFBQYGBgXFzc0aNHvavbi4sX3sFEMXzy7YgnNjb2/Pnz+HAyMwOYVrjcI8Rw/bQFhVulUonvlnyKx+cg2kHO2G/mAZs3b1YoFHAaAmy8kBPTYDBoNJrJtyOea9euTWV3wJSxcuVKYYEXxfURERE2m40giKnJienxOXj69Ol169ahBF+ToampaWxszFubEYCZhIdzYt++fceOHbt3794ff/xRWlqK8whNEreytU/n1O58XL58edeuXXzfjo+Pb9269e+//xbZ2rSywIz3nVvMnj07PDzc45yYYpj8OTgyMoJ2LeMS9ouTCPyqJh8oJ+miRYvcHgYw4/Hs9ken061atcrf3z8mJqa+vt4rt1RGo5EzJYlL4RdorSw+Pr6mpkZAICsrCz9IFMYtc/kaj30HeMzkz0F/f//U1FT6U272ZjD2ljAAcAvv5MQUc5VHqWQFBKqqqtAWVXZrtbW1Go2GvmqMhX1KYWGhVCptbm72ShgbHBz08/PDp7TZbE5KSgoKClKr1Tt27EBvden1evyytzDYAg8fPiwoKIiMjJRKpbGxsTU1NW69YCxyaMLum4a+AwBgOuC1vMsCiSgQLq9la9asOX36NFuys7MzKCgIb3hlCPsOFBIMBgO6ZLscoEsY49JoNDk5OXa73WazZWRkpKens2UEwBZAe1jNZvPAwEBnZ+f69et7enrcUkzM0IQVm26+AwBgmjB1uf2FL1L0RP10yb6+PqVSSX+nj5pcVn9vKTzJBvnylovslJ7cfmqSigsoNg19BwDANMH1M/+nT5/u3bs3JCRk3rx577333v3799G/xe3fv1+lUi1atOjYsWP0P6GbP3/+l19+GRISsnDhwg8++OCff/4hCGJkZCQqKsrhcMyaNeubb75h99Le3r5p0yZG/tQnT56kpqZmZmZu3bqVT/jXX38VozNBEI8fP/7oo49UKtVLL730+eefo3+pQwofOHAgOjp64cKF27ZtQ/+1d//+fbrCjAGyx45amDdv3vvvv3///v1PP/1UpVIFBwdv376dMw9rQEDA7t27UZvj4+Pffffdhg0bhB1BHym2wMTEBEEQOMuISzsI+I7w1H3e9R0AADMJ1zGGL585Xz58zjT77HTlDDjzj+Xl5V28eJG9YYYuzJl/m1Nnt9LvBwcH8ynMHrvI/P+cCOQtxzASidMtIJxU3F3fER65z7u+AwBgRuHyTocvnzlnPnwrf5p9gcUWRrZ2JNnY2BgbG5uRkZGamiogzJl/m62zu+n3GQozBsgYOyEi/z+fBRh5yxkynInEGRYQSCrulu8oj9zndd8BADCTcBFjxOQzp569BPOl2ReIMYxs7SgfolqtNpvN/f39MpkMZU7kFEbQ829z6uxu+n2KP8YI5J5htCDQIAOct5whw5lInNMCFCupuLu+ozxyn3d9BwDADEPUO5iTyWcuBvZiy8TERFNT09KlS0NCQvbs2VNUVCQgfOPGDZRkEOffngKdJ8n4+PiFCxfwITtvOaKyslKn0+Xl5d24cQMX8v2vAU4q/uOPP+LCF9F3AADMGFzEmAULFigUCrdeySZJ8vbt2+izxWKJjIwUln/69OnJkycZl57AwMC3334bfS4uLh4YGDh27Bin8K5du+Lj40NDQy0Wy969e/l0VqvV/v7+f/31Fzo0m81RUVHiB+V1JiYm1q5d++DBA3TIZ6i9e/daLBa1Wh0fH48SBLAtwHgMQ5Kk0+kkPPId4ab7vO47AABmGK7vYwoLC3fu3HnlypU7d+58/PHHZ8+edVmlqKjozp07V69eraioSElJQYVKpZIkyT///JMh3N3dHRoaGh0dzdfa3LlzKysry8rKHj16xBZ2OBwmk+nAgQP4H7E4dZ49e3Z6enphYeHt27eRYhkZGS4H4l38/PzQ1Z8giICAgKSkpLy8vDt37ly+fLmkpAQ90nc6nYxNYsHBwf/73/9MJpPD4SBY5rp27ZpGo/nqq6/u3r07MjJy9uzZvLy8nJwc9K0HviPccZ8vfAcAwIzC5Wqay3zmFOtxBWeaferZdOUYdrZ2zqX/+Pj4kpISztTuYnSm3Ey/T/ngeQxJklKpFD/c5sxbfuLECeG/j2VbQCCpuFu+o9x3ny98BwDATMLL72B68N6iW9naX5TU7nwUFBRwPq5HkCQZFRXV1NQk0IJPLeCu+/5TvgMAwANmURTlxbuiW7durVixwmWW1v8sjL8oZ3Pu3LnXX399KlWiA+4DAMC7wP89TClz5swRCDAEQTzHAAMAAOB1IMYAAAAAvsLLa2UAAAAAgIH7GAAAAMBXQIwBAAAAfAXEGAAAAMBXQIwBAAAAfAXEGAAAAMBXQIwBAAAAfAXEGAAAAMBXQIwBAAAAfAXEGAAAAMBXQIwBAAAAfAXEGAAAAMBXQIwBAAAAfAXEGAAAAMBXQIwBAAAAfAXEGAAAAMBX/B+Xe57gdB0mCgAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAH5UlEQVR4nO3bb0hT3x8H8Ov8sbm2aZu75tTy30ATiRARBZOQCjEZEmxK+SSCBWI6osLM7I+kUhk+EJOwSInoQYyQCB9IiIqUxbzNGf7DnKnzz5yudEzT7fvg8LvsZ/6Z5rJf3/fr0T1353zO5xzBD/fczcvpdFIAAAAewNntBAAA4K+FGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ7yW2uM0WgUiURbGmK1WsvLy7c93NX09LRSqRSLxV5eXl5eXjKZrKCgYHFx8dcjb2zT4K5r3PHgAAC76E9/jpmbmysrKyPXoaGhZrN526HUavXS0hLDMHa73W63t7S0GAyGioqKX4+8sU2Du64RAOBv8qfXmFV4PN72Bv748eP169d1dXWhoaE8Ho/H40VFRZWVlWm12l+M7A6PBgcA+GNtUmPIUUxlZWV4eLhAIMjKypqZmbl8+TJN0/7+/mfPnl1YWCA9P3z4kJSUxOfzaZpWKpVjY2NkbHl5OU3TMpns8ePHrpF7enr8/f3b2tpIc3Fx8dy5cyKRKDQ09MaNGysrKxRFWa3WsLCw+fl5Ly+v+vp69lzINSuxWHzmzBmr1cpGNplMJ0+eFIlE4eHhlZWVYrGYoqiJiQkul0vTNEVR79+/j4yMFIvFb968GR0dpf73xMn9JS8sLJw/f56m6f3799+6dYvknJWVdefOHTaZpKSkBw8erAruuifrrZHtT/Jfc4c3/tutrKxcvXp13759AoFAqVTOzMysl7P7SwYA2JLNn2Pm5+cZhmlvb2cYZnx8PDo62mw26/X6d+/eDQ8PFxUVkW46nU6tVk9MTBgMhpCQkLy8PDK2t7fXYDA8ffo0OTmZjWm1Wk+dOlVRUXHkyBFy5/bt2zabTa/XNzU1tba21tbWUhTl5+fX29srFArtdntOTs6qrPR6fUdHR2dn58jICJsGRVF5eXlcLndwcLC5ubmhoYHcdDgcHA6H7aBSqfr7+3U6ncPh2PaS8/Pzx8fHdTpdU1NTY2NjTU0NRVEqlerVq1ekg8lkYhjmxIkTq4K77skGa1xlzR3ewN27d5ubm5ubm/v7+4OCgj5//rxezu4vGQBga5wbGh4epihqbm6ONNvb2zkcjs1mI82Ojg65XP7zqMHBwcDAQDLWYrG4RhMKhU6nMz09PTc313WIVCqdn58n1wzDJCQkrBriek0if/v2jc0qIiKCXC8vL/v4+AwNDZGmVqvdu3ev61ibzcbhcMxms9PpfPv27apP3V/y8vKyUChkJ2psbExMTCTxfX19R0ZGnE5nTU2NQqH4Objrnqy3RrZJMlxzh3/u7yogIECn07neWS/n7f2VAQA2tflzjFAo9PPzI9chISG+vr58Pp80g4KC2LfZXV1dx48fDw4Opmk6ISHBbreTsexRD+vatWtNTU3x8fHsndnZWbPZHBYWRtM0TdOpqankv97GWbFnSiEhIRaLhVxPTU05HI7w8HDSjI6OXjXQYrFwuVx/f38ycNtLnpqaWlpacp2I5Mzn89PT08mjjFarValUPwf/eU/cseYOr8dqtVoslkOHDrneXC9nN5cMALBVO/bOPzMzMyUlpbW1lWGYN2/erNfNZrNptdoXL14UFhayL1HsdjuHw/n48SPDMAzD6PV6hmF2KrFVXA/N1jwo+3XkuGx2drazs1OhUOxUWDd32JW3t/dOzQ4AsA07U2Omp6fHx8evX78eGRkZHBzs4+Oz7nwcjlarVSqVCQkJxcXF5KZMJtuzZ4/FYgn+L5lMtr1MAgICOByO0Wgkzd7eXnZeUlEkEondbp+dnaUoamRkZHuzkIm4XO6XL1/YicLCwsh1eno6wzANDQ3Hjh3b6o9XJBKJzWb7/v07aZKvJFBb2WHCz89PIpF8+vTJzZwBADxhZ2oMTdMSieThw4dWq3VgYODmzZvr9fTx8Tl48CBFUffv36+rq+vu7ib3c3JycnNze3p6TCbTvXv3SktLyX2pVGq32wcGBtzMxNvbOyMjQ6PRGI3Gnp4eNhOpVLq0tNTV1SUQCJKTkysqKkwmU3V19XZXTHl7e2dnZ2s0mq9fv5KJTp8+TT7i8XhpaWklJSXZ2dnuhHJdo0gkio+Pv3jx4uTk5MDAQGFhIemz3g6TktnX10e+IUZ+UkpoNBq1Wt3d3T02NnbhwoW2trYNcgYA8IQdOyt7+fLlkydPAgMDU1JSIiIiNu0fFRWlVqvZL0dVVVUlJiampaXJ5fKWlhb2G1YCgaC4uPjw4cP19fVuZlJdXb28vBwbG5uRkcH+D+Xz+fn5+Y8ePaIoqra2tqmpKSYmJjY2dsvrdFFVVRUYGBgXF5eWlqZQKHJzc9mPVCqVw+HIyMhwJ86qNT5//nxoaEgul2dmZrq+zllzh0Ui0aVLl+Li4p49e2Y0GqVSKdv/ypUrR48eTU1Nlcvlo6OjMTExG+cMALDjvJxO527n4EF9fX0pKSmTk5OkubKyglcUAAC/zf/Z7/y3imEY14cqFBgAgN/pP7udwM4rLS0NCgpSKBRDQ0NFRUUlJSW7nREAwL/UX3hW1tbWptFoDAbDgQMH8vLyCgoKdjsjAIB/qb+wxgAAwB/iL38fAwAAuwg1BgAAPAU1BgAAPAU1BgAAPAU1BgAAPAU1BgAAPAU1BgAAPAU1BgAAPAU1BgAAPAU1BgAAPOUfx5aGUFVGGAAAAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 27 April, 2020 12:47 GMT
Vulnerability Verified: 28 April, 2020 10:22 GMT
Website Operator Notified: 28 April, 2020 10:22 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 28 April, 2020 10:22 GMT
Vulnerability Fixed: 2 May, 2020 22:32 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 27 May, 2020 12:47 GMT