Lucene search

K
openbugbountyDkilerS2OBB:1157502
HistoryMay 07, 2020 - 10:35 p.m.

bursa.com Cross Site Scripting vulnerability

2020-05-0722:35:00
DkilerS2
www.openbugbounty.org
5

Open Bug Bounty ID: OBB-1157502

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: bursa.com
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: DkilerS2
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAVjklEQVR4nO2dbUxT1xvAr1iwwgWklIpYBBxBQgw2jjHm2ObQOEcIqw6ZMjLZJIgGGOmQiDOOdQYNwmbMRvyAi9NlJoshhBjDDHNbR4hDZBU7ZB0SrKUyLAiuutIVzv/DjTf3f996W3rLi8/vU8/tuec8b+Xhnp4+ZxFCCAMAAAAAEfCbbQEAAACABQvkGAAAAEAsIMcAAAAAYgE5BgAAABALyDEAAACAWECOAQAAAMRi7uaYuLi4mzdvcjUBj/G6JcE1vuTmzZv79u3j6fDff//t2rXr77//9plIAMDDHM0xt27dmp6eXrduHWsT8BivWxJc42MKCgpiY2N5Ovj7+wcEBFRUVPhKIgDgw0WOuXv3bnBwMOtbExMTx44d42rOkJaWluzsbK6mD+BRfF7jdUv63jUC8ZYH7969GxYWJmQi/p4ey0P9ZI2Ojvb09JSXl5PvTk5O7tq1izZyeXl5W1ubcNmEwBzKi4PPOzEA4Xj+HDM+Pl5TU8PVnCGznmMWKs9OjlkwUD9ZNpstMDBwyZIlRHNycnLr1q1Op5N2i0wms9lsPpUSADiYi2tl9+/fNxqNGzduZG0CHuN1S4JrMAyTSCQJCQnUFz5jeHh48+bNdXV1XB28KBtzqFlRfI6IAbgB4mVwcBDH8ZMnT8bGxspksvz8/PHxcYTQ+Pg4OcLZs2epzfr6ehzHa2trFQrFsmXL3nvvvSdPnhCjdXZ2pqen4zgeFRW1ffv23t5e1klPnz6dm5vLbKrV6traWuKiXq8PCAgghEEIFRUVVVRU8HeIj4/nv52p+PHjx2laENep3ZYtW0Zer6mpkcvlkZGRjY2NXPp2dnampaVJpVK5XJ6Tk2M2m5kWcDqdBw8eVCgUgYGBOTk5VqsVIWSz2YqKiuRyuVKprK6udjqd5Lx1dXWxsbGBgYG5ublWq7WiokIul8tksoKCApvNxmpYVjG4tOASmOYpktbWVnIWpgVyc3OPHj1Kdk5LSzt79qzFYsnMzMRxPDY2tq6ujrAqDaYFqOovW7YsLy+P9CnNU6zW49LObDZv2bIFx/GEhISamhpWYfhhDkuTByFkt9s/+OADHMdXrVp15MgRUh2q/WkfNOYgTE1ZrwiB9JpXEO56hJAQ7wPzFNfPMTabTa/Xd3R0dHZ2WiyWgwcPYhgWGhra19eH47jdbs/Pz6c2t23bZrPZOjs7u7q6urq6uru7a2triaGysrIKCgpMJlN7e3t6erpUKmWdkWuhLCsri1hlxjDs0qVL09PTra2tRLOtrS0zM5O/g1qt5r+dqXjXU6ha8Biqr6/PYDCcPXs2PT2dS9/u7u6ioqLh4WGDwaBUKktKSphD1dbWtrW1tbW1GY3GqKio3t5eDMPKysosFkt3d3dra2tLS0tDQwPVQe3t7Xq93mKxJCYmWq3Wnp6ea9euDQ4OHjp0iNWwXGIwteARmLlQdv369U2bNhUUFBBNVgvk5uY2NzcTHe7fv6/X69VqdUlJSUBAQH9/f1tb27lz51gtzGoBm83W09NDxKfJZKLq6/JeLu1KSkpCQkJ6e3svX7783XffkYNEMGCdi99oJFqt9smTJz09Pa2trTqd7vTp00z70z5oXNPNEJrXhKvJg3DXYxjG5X2vSALMMvwpaHBwEMOwR48eEc2Ojo7Vq1eTb9H+oyeaxC0mk4m43tTUlJKSghAaGxuTSCR2u505i8lkio2NJV7bbDYcx8fGxphNi8USGBhIjJCamqrRaPLy8ogZQ0JCHA4HfweTycR/O1NxphY8zzEYhpFi8+tL0t/fHxkZybyuUCi6u7upV5xOJ47jAwMDRLOlpSUtLY2cl/znvb293c/Pj3xw7OjoiI+PZzUsqxhMLXgEpg1oNBpzc3NlMllNTQ3x8MRlgSdPnhDuQAg1NDRkZ2c7nU6pVEpq19TUxPxPltUCtPhsb29njU8u67FqRwhDdT0pjJkBl6GYwzKfLeRyOfmUqdfrU1NTWe1PvdHrzzFMr3msJhXhrkcI8Xh/5pIAs47EZRLCcZzctRIVFTU2NubyFqlUGh0dTbxOTEw0mUwYhoWFheXk5KSlpWVkZERFRaWkpLz22mvksB0dHcTrK1eupKamkvtDqM0VK1YkJCR0dHQkJSVZLJYjR44kJCRMTU21tbVt3rzZ39+fv0N0dDT/7UK04DcUdVsLl76///57ZWVlb2+vw+GYnp6enp6mjTMxMTE2NpacnEy9ODIy4nA44uLiSHmIv0fEvKGhocRrpVIZEhKydOlS0rBWq5XVsFxi0LTg6UkbMCkpKSsra2BggBSGywJLly7NzMxsbm4uLS1tamoqKCgYGRmZnp6masc0L5cFqPGpVCpZ45PHekztRkZGMAyjup4cZ+XKlczBWXHp5YcPH1qtVnIX8vT0tEQiwdjsLypMr2HuqMmFcNdjGMbj/ZlLAsw6Pv3O/8KFC42NjcnJyQ6HQ6PRlJaWEtcXL168YsUK4jX/jrLMzMy2trZLly5lZWWFhoaqVCqdTkdd6eLv4PJ2H+irVqtfffVVnU6n1+svX77Mde/ixYu9KwzNkgLF4OlJG1Cr1ep0uv3799+5c4e8yOVxYs3k4cOHnZ2ds7stTbgdMHeWblwOa7fb/fz8urq69Hq9Xq/v6enR6/UzVcZ9WL3mlRUqr7ge1soWAvyPOVxLQ6xvsa6VNTc3E6tMNPR6vVKppF10Op1yuZx8aqY1EUIdHR2pqanZ2dmXL19GCDU0NJSVlUVGRlosFiEdXN5OVYdVi0ePHvn5+VEXZ6jf+fNYktB3ZGREIpFQL7J+valQKPR6Pc0yXGtlXA6iNmmW5BKDqQVXT6ZrEEJWq7W8vBzH8eLiYi4LEK/tdrtMJjt58uT27dvR09WSwcFB4l231sqExCeX9Vi1o62VNTc3u7t0wzos07Y4jtNWRF0uhYnxnT/Ta15foeJxPeL1PqyVLQA8zzE2m00ikRiNRlqT+OtM7KUxGAwqlaq6uhoh1Nvbu3Xr1qtXr1qtVpPJVFhYmJWVRY5MLN3qdLq1a9eSF2lNAoVCoVAoiP5mszkkJESlUgnvwP8uuYLMpQVCKDU1tbCwcHh42Gg0pqenc/115tJXoVA0NDSMj48bjUa1Wk3ak7p4XVNTk5qa2tPTYzabS0pKdDodQqiwsDA7O9tkMhkMhvXr1586dYrfQdQm05KsYrD+bWLtyeoactL8/HweCxDk5eWFhIR8//33RDMnJ0etVg8ODhoMhuTkZNbUy7QAj/qPHj2SSCR9fX3EFjJW63Fpp1arqa73YJsTc1iaPAih4uLitLQ0g8FgsVhqa2u1Wi2r/akfNJPJJJVKmQan3dXf3++uzKTXvIJbrkfCvA/MUzzPMQih6urqwMBAYvch2ST2LjN3/Tocjurq6oSEhICAAIVCkZ+fPzw8TJuloqLi0KFD5Pi0JkFeXl5OTg7ZTElJofXh78DzLvMfRtYd2P39/RkZGTiOJyUlnTp1iuuvM5e+Op0uJSVFKpVGRkZqNBrW251OZ2VlpVwul0qlarXa5d5lLgeRTaYlhYjB05PVNTR4PI4Qam5uxnGctOrw8HBWVhaxe/X48eNu7V3mUv/gwYNkfHLtXWbVjrp32bOttKzDUuVBCNnt9vLycqVSGRgYmJmZOTAwwPX8QX7Q7Ha7VCol/7EjtabddfHixeTkZHdl9iJuuR4J8z4wT3GRYzzAs735BAkJCdeuXeNqAh7jdUuK6pq+vj6FQiHS4POdsrKyjIwMng52uz02Npb4bdN8BLy/wHC9r8yX/PnnnzxNwGO8bklRXaPX61evXi3e+POauro6/t0BS5Ys+fbbb19++WWfieRdwPsLjLlYSwaYv3hc5/+zzz47c+bMgwcPfvvtt0OHDhUXF3tdtoWBv7//Cy+8wN9n3iUYb3mf/+ADOPVgVoAcA3iNmdT537hxY0NDg1KpzM/PLysr2717t9fFA+Ys3vI+/8EHcOrB7ODB+hrtG5fy8nKpVEp+kwnQ8OALKtp317MoiVscPXq0pKSEOcuzECFCbEtUUPbZdMxb5mxQeTwI1aRWq9XPz4+6P9Nut+/cuZM6cnd3N2tlDUA8PHmOiYmJIX89Pjo6eurUqWvXrolXTGm+QzXXwob4VSZN32ckQoR42YvnXzw7QcWPuwcfwKkHvsfDtTLSkYRf161b5/XfpS8kSHMtYKh1/qn6PjsR4mMvPwtBNRNcHnwA+Ab3cswPP/yAUQ6eGx0djY2NtdlsixYt+uabb4jrx44di4iIWLFixZkzZzAMu379+ksvvbR06dKIiIgdO3YMDQ2RI9TX18fFxQUFBb3zzjujo6MHDhyIiIgIDw9///33Hz9+TMw4OTm5Z8+e4ODgmJiYTz75ZGpqiioPdZywsLB33313YmKCeEvUeals27btxIkTxOubN28uWbKElGHv3r0HDhygntPHJS2GYUNDQ2+88UZwcPCaNWuotX4fP368d+/eiIiI6OjoTz/9dGpqSuCMJ06cWL58eVhY2O7du//991+m5Iv+H6qLBULt3NLSsmXLFn9/f+qBj9QI+fzzz30WHsK1oPa8fv36K6+8EhwcvHLlyrfffvv27dsYhk1NTVVVVS1fvjwoKGjHjh2jo6OkhFRdaF5mGn9iYoL6YXEpJL+X9+7dSxqZJ66EB5XAGV0GFcYRV1QjMz1Og9WtTJszTUolJibm448/5rEw4BuE5hha9W+C8PBwWuFx4ZXhBVakZ61/ToWrtLtI8zILKLk8cUCItBh3PXlmUXohM3Idr0DF/pTKysqdO3cSFwsKCjZt2nTjxg2WIKDAjAfWAzGpEUIc+uCb8BCiBVMF1nL0rOcsYGyhTsJqfGaVfn4h+b38+uuv02ZkjSvhQSVkRiFBhXHEFYnHpx4wbe6bgw+AmeLyGxtm9W+uAkrCK8MLr0jPrH9OHZCntLtI8zILKLk8cYBWyY1VWq568qyFtoTMiAk4mIDAYDCsWrWKKCWAELLZbDU1NTKZLDc3l/Z7cgLWavDUOv/8hex8Ex78WrCqwFWOnnnOAqsuLs+2YFqGX0h+L/f399M+d8y4ciuohMwoPKgQI65YoXqcOgirW71y8IHY214AJq5zjEQiUavV5Ace8eYYpv+6u7s3b94cFRVFnMzIWrOEqwIKUadd/hSZTEb7ATDPOKLOS0OlUl29enV4eFipVI6PjysUCqfT2djYSFT9o/714ZrdYrFQ61D19vYSb1ksloCAAPK60WgkPpMuZ6SNRsjP6qANGzY0NzfTLo6NjanVamphRxJmPCCEmpqayB+f8+QYH4cHlxasKiCEdu7cqVKpNBpNXV3dzz//jBAaHx+XSCRk4RmmUqxqshqfywI8pubxMs/njrSPu0HlckbhQYU44goJ8DiXW71SMBRyjO9x/Tt/rVZbV1e3f/9+rVb73HPPufucpFarCwsLT58+LZVKzWbz1q1bhd9L1j8njtbAMMzPT+jinkjzMquLP3jwgDgyYGBgwDdHBmBPDymY+YxfffXV6tWr33rrLerFO3fuHDlyRKfTabVa5i2s8cC6UCYE8cKDRwuukL5w4cKNGzeIIpUajWbDhg1Hjx7FRDhnQYiQmPe8LBxR44rApcdn8qkH5iJCEhGt+rfw5xiBNeS5/lFFbPXPqXCNI968rMXG+Y8MEPIcw1VPnmtZw+WMGNvBBDQBzGZzYmIibfGhuLgYx3GNRsOzykGLB1qdf+HPMeK5yaUW/McQIEo5euY5C6y6cK2VUc+2oN3lUkgeLwt5jnE3qFzOKCSoEEdcEQj0OKtb4TlmnuLGbzAHn1b/dmutTEgNeZ4/Isz65zSRuMYRdV4mPEcGCMkxiLuePE9Rep4ZMbaDCWjl5bdv337x4kXyG1ri3vz8/MGnJ3nwQ8YDrc6/W2tlIrlJoBaDlIL2XOXoWc9ZcJljWE+FoB2HIURILi8LyTHI/aDin1FIUCG2uKJ+y8XqcdogrG5ljR93Dz7w4NQDYIbM9Hf+LnOMkBryPH9EmPXPuSSh3SjqvEyEHBnAPztXPXmuovQuZ2Qer4D+v7y8B0+0rNDq/LuVY3zsJh64ytGznrPAn2O4jI8Yx2G4hMvLAnOMu0HlckaXQYUYcUUTj9XjtEFY3cr1COLWwQezfurBM8gixIgJYL5z9+7dtWvX/vPPP76Zbs2aNefOnXvxxRd9M90cx8fG9xnzQq8PP/zQYDD8+OOPrO9OTk4mJiYePnx4z549PhbsWWZu1fYH5iNwBAMwR+A/+GC+n3owT5nphg2Pa7kDAAB4F5cHH0CC8T0zyjEzqeUOAAAALHhmlGM8/lUEFWp5Ky4mJiaOHTs2w4meHWJiYub4uvkCZqEaf6HqBYjN7OcYHxdFBwAAAHyG5zmGWst9hkCVcgAAgAWJJ7X9Ccha7tgcK4oOAAAAzBE8r+1PXSibU0XRAQAAgLmCy19puqzlPteKogMAAABzBNfPMUlJSQ6HY2BgoKqqKigoiLh45cqV1NTUsLAwDMPCwsJycnLS0tI++uij+vr6X375BcOwiYmJsbGx5ORk5oA4jhM3MpFKpdHR0cTrxMREk8nE2i0oKKiqqqq/v9/hcCQlJblUAQAAAJgVXOcYrVar0+n2799/584d8iJtR9mFCxcaGxuTk5MdDodGoyktLSWui1oUnShQyFoUHQAAAJgLuM4xVVVVRqNRoVCoVKp9+/ZhGDY1NXXp0iXaruXnn39+9+7dVVVVX3/9dXNzc2hoqEwmc7cEgN1uv3fvHvHaaDSuWrWKtdu+fftUKlVkZKTRaKyqqnJrCgAAAMBnCPrOPzw8/IsvvjAYDDabDcOwjo6OyMjIuLg44t3bt2+/+eabP/300+jo6L1797788kuVSoVhWHl5eVFR0a1bt4aGhkpLS3/99Vchc2k0mqGhoT/++KO6ujorK4u4KJfL7Xb7X3/9RTRtNpvBYKivrw8PD3dXYQAAAMBnuLF3OSYm5vz58xhjoSw+Pj4tLa24uDgqKiolJcVutzc2NmIYVllZuXHjxoyMjPj4eLPZLOSLExzHU1JS1q9fn56enpycXFlZSVwPCgo6fPiwSqUi9i6fP38+JibGLT0BAAAA3+NJbX+RarnPi+LhAAAAgHA8qe0PtdwBAAAAIcy0tj8AAAAAcAE5BgAAABALOGsZAAAAEAt4jgEAAADEAnIMAAAAIBaQYwAAAACxgBwDAAAAiAXkGAAAAEAsIMcAAAAAYgE5BgAAABALyDEAAACAWECOAQAAAMQCcgwAAAAgFpBjAAAAALGAHAMAAACIBeQYAAAAQCwgxwAAAABiATkGAAAAEAvIMQAAAIBYQI4BAAAAxAJyDAAAACAWkGMAAAAAsYAcAwAAAIjF/wAxHqhDbfb1hAAAAABJRU5ErkJggg==)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAP/klEQVR4nO2df0wb5R/Hb1ig664MutIh1sGIYfyxMGIQUXGZjsyFEOyQVYbEoVsADSISXBSNIi7dwpgxSyT7gyW4LJqYZSFkIZjUxTSETMDmqA2yhpmu6TrUgmXesGC35/vHfXc571ev7V1pt8/rr/Z47nk+z/N5nn7unjvenw0IIQwAAAAAFCBlvQ0AAAAAHlggxgAAAABKATEGAAAAUAqIMQAAAIBSQIwBAAAAlAJiDAAAAKAU8Ysx27dvn5mZiVtzDzkzMzNvvfWWSIF///330KFDv//+e9xMAgDgISROMeaXX365d+/erl274tMc0NTUlJ+fL1IgNTU1LS2tq6srXhYBAPAwEqcYMzIyUlNTE5+2IuLGjRtarVauqrKyssI2JF4sFpOWl5dPnDiBYdji4qLD4ejo6GD+dXV19dChQ8yaOzo6rFZrpOaJw61HrprjbwbXEe+9997GjRu//vprBUxOeqKYtwpNCRkXNRA7D3uMeZAIBAIWiwXDMJIkNRpNeno6/afV1dX9+/eHQiFmeZ1OR5JkvK1MHvLy8vx+P/11cXHxzJkzV69ebWxsXEerEhbWcAEARTxizK1bt1wu1549e+LQVsKiUqkKCwuZH+LJwsJCZWVlf3+/UAG5zOPWsy4dl8sMZpymIveuXbseeeQRBUx+EGAOFwD8HxSOycnJ8vJytVqt1+vr6uq8Xq/b7cZx3GKx6PX6nJycwcFB3mJ0DWfPnjWbzdyax8bG6CYqKipwHM/Nza2trZ2dnUUImc3m48eP04XLy8uHhoYQQj6fr6qqCsfx/Pz8/v7+zMxMVrUkSTY3N+v1eqPR2NPTEwqFEEKUzf39/fn5+ZmZmQ0NDYFAgD4ufq5I77xe7759+3AcLywstFgsXGMiHVuuScFg8M0338RxfNu2bZ988gmzO0wXBAIB2qenT59m1kDDqpn1VSK01+SC6/2oXS8XVB+Z48O8QqeGV8r8Z846jUZjNpv9fn9XV5der9fpdE1NTSRJUvXzeplGaPbSA8i7QmNvl4nJZOrr66M+EwSRlpZG29Dc3NzV1cUcLhGDhZYM79ITb7S5uRnH8b6+PoPBkJmZ+frrr6+srCDOxOb9xZN9GgNChL+Psdvtzc3NCwsLTqfTaDS2tbVhGEaS5NzcnNPpHBoaqqioECpGwd0om5qa2rt3b1NTE/W1urq6qanJ4/GMj49XVFSo1WoMw8xm8/DwMFXg1q1bBEGYTCYMw9ra2tLS0ubn561W6/nz57kGt7e3+3w+u90+NjY2MjIyMDBAHSdJ0uFwTExMTE5Oejye7u5u6ecK9a6trS0jI2N2dnZ0dPSbb76h68nmIH1sWfT29q6srDgcjrGxMZvNdvbsWbo7TBds3rx5bm4Ox/FgMHjgwAHe5mKE5TVMcjfF4Xo/UtfLYoZQHym2bNnCHF7p858kSYIgxsfHCYLw+XxFRUV+v9/hcFy9etXtdtOTUMjLNCKzV2iFxtIud0irq6vpp3eXL1++d+/e2NgY9dVqtVZVVUk0WGjJ8C498UZfeOEFkiQnJyenp6enp6ftdntfXx/Xp8H7HDt2rL6+njrY1NS0d+/en3/+mVsekJmIItL8/HxOTo7b7cYwbGlpSbwY9ZkkSRzH6cIul8tsNut0OovFQl1MLS0tqVSqYDDIqmRlZSUjI8Pj8SCEBgYGampqEEKhUEitVv/2229UmUuXLrEuZkOhEI7jdIGRkZHy8nKEEGXz7du3qePj4+MFBQXov5c8QucK9Y4yhrKQZYyXg8iosqplXYXp9Xr6qpMgiLKyMro7LBfQJwrdoER9H8P1WtTdZMHr/UhdH7sZvH0UGi7p858qSV96j4+Pp6SkUNfaCKGJiYknnniC+szrZWbTvLNXqOnY2+UOqc/n02g0lKfKyso6OzsbGhoo2zIyMtbW1lj3MbwGCy0ZoaUn3uj8/DyGYczaSktLuY6jcDqd27Zt8/v91FeSJC0Wi06nM5vNLpeLdzABWQgfY+x2e2VlZW5uLnWjnZmZyetCbjHq+KVLl1588UW6mEqlMplMzDt9hFB9fX1JSUlnZ2d/f/+PP/7IPH7mzBmEUGVl5YULFxBCPp8vLS2NLjA7O8uKMawCLpeL94fb7XZTJzKPC50r1Dufz6dWq0WMCQtvtUyTlpaWMAzT30en0xkMBm536E4pFGN4vSYXvN6PwvUxwu2jSIyROP+FZh3rq5CXRSxh1hN2hUbdLouSkpIrV64sLCwYjcZAIGAwGEKh0ODgYG1tLctIIQOElozI0hNp1O12s2oTWR3PPvvs8PAw6+DS0pLJZFKpVCK9BmIk/F6ZyWTavXu3zWYjCGJ0dDTSYqyNst7eXpvN9vbbb1+/fp0++O233w4ODhYXF6+trXV2dr7zzjvUcWrP5K+//pqcnFzf19IkDgKNxN2bsNUGg8GUlJTp6WmCIAiCcDgcBEHE2pnI4fUaJtMmFa/3I3K9LGYI9VEikc4QJjF6OeqmRdrlHdKqqiqr1Xr58uXq6urNmzeXlJTYbDbejTIZkaXRr776qqCg4OWXX2YevH79eltbm81m6+3tldtqgIF4CPrjjz+YQZ4gCN77GN5iCKFQKKTX6+lbYAq/39/R0YHjeGtrK7dFgiCMRiP1ORgM6nS6L7/8krpQQvfvtd1uN/U1or2ysPcxQueK9I554z88PBzR7o1QtSxTcRy32+2sc+N8H4MEvCbLJhUT2vsRuV4uM1h9lH4fI9GVQvcTSMDL3Ka5J0pZoVG0yzukExMTZWVlNTU1o6OjCKGBgYH29vacnByfz4ek3ccILRmRbWqRRqkdOWZtvHtlXq+3qKiItbfZ2tqK43hnZye9ewYoRPi9MoPBMDAwEAgEXC6XyWQS2ivjFkMI2Wy2nTt38lbrdrsbGxsRQrOzs/v3779y5Yrf7/d4PEePHq2urqaLNTQ0ZGRkfPfdd/SRuro6k8nkdrudTmdxcTF3w+To0aM1NTUej8fpdD755JPUlovQpL99+7ZKpZqbm6PeY+E9V6h3CCGTyUS9yeN0OktKSiLdveGtlmVSa2treXm50+n0+Xx9fX29vb3c7lCQJKlSqVwul8fjYe4hMHvNPGt+fj5Sg2mvyYWI96NwvSzQfYxor4zXldJ/63m9zG2at56wKzTqdrkYDAaDwUA9IPF6vRkZGSUlJVwjRQwQWjJCS0+kUSrGMGvr6elBnBVUW1t78eJF+sk/VWdjYyN9vQIoSvgYY7PZSktL1Wp1Tk5OZ2enUIzhFkMIdXV1dXd3i9e/trbW09NTWFiYlpZmMBgaGxsXFhbovw4PD+M4Tj+uRAgtLCxUV1dTL7CePHkyoneX6TLMSf/BBx9oNBrq7Vihd5d5e4f++yJmFG/TClXLNCkYDHZ0dBiNRo1GU1VVRV3rCd2C9PT0aDSawcFBtVrNfZLJOuvixYvFxcURGSw7It6PwvXyElGM4XWl9N96Xi+LWMKsJ+wKjbpdLg0NDXV1dfTX0tJSeoFLjDFCS0Zo6Yk0SrVy8uRJ1rvL6L8rKKKdG0B2NiCOD2Rkx44d58+ff/rppxWq/9q1a7t37wZhRy7vvvuu0+n84YcfhAqsrq4WFRV9/PHHR44ciadhcgGuB27cuLFz586///57vQ0BxFApWvu1a9cUrZ8giIKCAkWbSFL6+/vFnxunp6dfuHDhueeei5tJ8gKuB4CkIFYtmfgr9n/++efnzp37888/f/rpp+7u7tbW1ni2niykpqY+9dRT4mWSLsBwXS+ewiCW/AWQigIAZCGmGLMuiv179uwZGBgwGo2NjY3t7e2HDx+OZ+vAOsJ1vXgKg6jzF0AqCgCQjVge5hw/frytrY37CLSjo0OtVlMP3B5UpLz4Swkhx6057ilKPBWPwhIZK2EOqd/vT0lJYWoEBIPB+vp6Zs12u53+bz7pUBM7CvOYxHmGAEBiEtN9DPX/lQ+nBLoUJXNabD8+zT0MMIeUlcJAxvwFsqSiiPMMAYDEJPoYw1Tsfzgl0OOsZA7C6eKEzV8gERlTUYDLACCyGPP999/Tn0dGRvbt25eamsrMOre4uJifn0+S5IYNG7744gutVnvixIns7OxHH3303LlzGIZNTU0988wzGzduzM7OPnjw4M2bN7H7eetOnz69ffv2TZs2vfrqq4uLi++//352dvaWLVveeOONO3fuUPWvrq4eOXJEq9Xm5eV9+umnd+/e5RomvQtTU1PPP/+8Vqt97LHHXnnllV9//RXDsLt373744Ydbt27dtGnTwYMHFxcXaQuZfWHmVdRqtadOndq6dWtWVtbhw4f/+ecfDMOWl5fpoaAyJ4obeeDAgVOnTlGfZ2Zm0tPTl5eXqa8tLS0tLS30IDOHKysr67XXXqNL3rx586WXXtJqtTt27GCK2t65c6elpSU7O/vxxx//7LPPqHGT0iK3X1w2/BfWX3k9zoLXrdwx5w4pk7y8vI8++khkhIVg+YWe2FiCzRAASEakxhiu5jnvfsJ6SaBLUermdoE3p0BfX5/VarVarS6XKzc3d3Z2lraQ1RcaXoFxptg+tW0obmRYGXNWiwkinI4JaKfTKJS/QJadWF4lf+bETqgZAgBJSdgnNry67kzF/kSQQBdX6ubtglBOAYPBwKsPxuoLq5tcgXHuyIgbGVbGPJGF0xFHO50XGfMXCFkiUZNNKFsBc2In2gwBgGQkfIzh1XVnKvYnjgS6kFK3kDQ9V1U+EAioVCpuNkBuX5jd5BUYFxoBETlxcRnzRBZORwLa6Uix/AVSCohYKzQlWKkoEm2GAEDSEX6vjFfzPOoXb5STQBdR6haSbRfKKaDc2wricuLx106Xq0Ve7XSKxMxfIDQlWBM70WYIACQfUgIRS/OcpdifCBLoYZW6xRMKIIaqvMFgIAiC9Vfxq1SMT2Cce1ZYI8VlzBNTOB0JaKdTKJe/QEoBoTIU3CnBm4qCafy6zxAASDoi+B9MWvOcpdifCBLoEpW63QxpeiFVeYvFUlZW5nA4vF4vdUXJ2xfWLwhXYBwxxPalGykiY56YwumITzud+QxDofwFCCHeFAass8LmL2BOCdbETswZAgDJRTT/589S7E8cCfSIEFKVD4VCx44d0+v1arXaZDJRV5TivyBCAuPovti+dMkDcRlzVtP013UUTkcc3W6WeQrlLxgaGgoGg9wUBqyzIspfwJrYiTlDACC5iEbbX2nF/uTiQRUYT4p+iacwiDR/gUITOylGEgAUIhptf6UV+wFAIuIpDCLNXwATGwBkJ1ZtfwBYR8KmMEi6/AUA8IABMQYAAABQCmVzLQMAAAAPM3AfAwAAACgFxBgAAABAKSDGAAAAAEoBMQYAAABQCogxAAAAgFJAjAEAAACUAmIMAAAAoBQQYwAAAAClgBgDAAAAKAXEGAAAAEApIMYAAAAASgExBgAAAFAKiDEAAACAUkCMAQAAAJQCYgwAAACgFP8Du76/Qm2E6icAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAGNUlEQVR4nO3cX0hT7QMH8Gczhmtn2dk8OqeWf3YhIiNsxIJl4VWBhFCzqMC6WRFqNmhkENhVJgQRUhEmdVM3EeGFeCEVNUTzZU5bOmaY29yy3FaruU6rbb+L5/0dxHrnXvK8L719P1fnPOf5c54z2Jc955xJ0uk0AQAAEIH03z4BAAD4z0LGAACAWJAxAAAgFmQMAACIBRkDAABiQcYAAIBYkDEAACAWZAwAAIhllYzxer1KpXLVXk6fPi2Xy+/cuZOhzuLiotlsZllWIpFIJJKioqJTp059+fIl+1EAAODXskrGbN68ORQKZa4TDoevXr06MjJy5MiRDNUsFksikXA6nTzP8zz/5MkTl8vV1dX1t08ZAAB+EZKf/y8Zr9dbU1Pz6dOnDHW+fv26fv36YDDIcZxQODo6arFYJiYmsukBAAB+OdmuldGNy5cvl5eXsyx7+PDhaDRKCAmHw2VlZbFYTCKR0LWypaWl48ePcxxXWlp64cKFZDJJCFlYWJDJZDRgRkdHKysrWZYdGBiYn58Xxrp06VJhYSHLss3NzZ8/fybfraF5vV6WZYXyixcvchxXVFR069YtQsjY2NiOHTuUSmVxcfG+ffump6dpq7Gxse3bt8vlco7jzGZzIBBYMcdkMtnR0VFYWKhQKMxmczgcpuXfT2T5RVAoFAcOHAiHw2fOnOE4Tq1WHzt2bGlp6Sc+CwCA/5q/cc8/FotNTk4ODw8/f/7c5/OdO3eOEKJWq91uN8MwPM/TtbK2trZgMOhwOAYHB/v7+69du0YISaVSUumfY7W0tDQ1NXk8HofDkUqlhM7/+D+Hw9Hd3b3qybjdbpfLdfv2bZPJRAhpaGg4evSoz+ez2+0mkyk3N5fWdDgcFotlYWHB5XKVlJS0tLSs6Kq7u3toaGhoaMjj8Wi12qmpKVr+w4nEYjGn02m3251OZzAYrKqqCoVCk5OTIyMjc3Nz9JoAAMCf0hnNzc0xDEM3CCEfP36k5Xa7vaKiYkWddDr97ds3hmFmZ2fpbn9/v9FoXF4nHo9LpdJQKJROpx89erRx40ahc5/PR1s9ePDAYDCs6JnuLq8fiUSEQ5FIZN26dTzPZ57Oq1evNBrNisKCggKHw7Gi8IcToeN++PBBuAhSqTQej9Pd4eFhnU6X+QQAAH4r67JPI4ZhhJWrkpKSSCTyfZ13794lEony8nK6W1VVRb+XBZFIRCaTqdVq2olQnpubW1paKrTy+XyrngxdN6NYlt2/f7/RaKyvr9dqtQaDYefOnfTQ+Pi4zWabmppKJBKpVEr45URFo9FIJKLX67OcCMMweXl5wkXYsGGDXC6nu1qtdtXnIwAAfiv/9PsxyxfNVnzd/6R79+719vbq9fpEImG1WltbW2l5Y2NjXV3d06dPnU7nwMDAD9vm5OSs4ZkAAAC1xhlTUFAgk8lev35Nd91ud1lZGSFEKpXSRFGpVDzPv3//nhCy/McKz/N+v59uezyeTZs20crxeFx43mz5AwI/tHXr1ubm5o6Ojr6+vocPHxJCFhcXg8Hg+fPnKysri4uLhZs0gry8PJVKNTExkeVEAAAge2ucMTk5OQcPHmxvb/f7/S9fvuzs7Dx06BAhJD8/P5FIjI+PKxQKk8nU1dX15s2bnp6e5W2tVmsgEKCtGhoaCCFKpdJgMFit1rdv387MzJw9e/avxp2ent6zZ8/jx4/D4bDf7+/p6dmyZQshhOM4lUp1/fr1aDQ6MzPT2dkpNKGvfxJC2tvbLRbLixcvAoFAa2vrs2fPMkwEAACyt/ZrZVeuXNFoNLW1tbt37967d+/JkycJIXK5vK2t7ebNm4SQGzduDA4OVldX19TUCK0Yhtm2bVttba3JZNLr9TabjZbfvXt3dnZWp9M1NjY2NTX91aA6nc5oNJ44cYLejOF5vre3lx66f/9+X1+fRqOpq6urqKighV6vNz8/n27bbLZdu3bV19frdLr5+fnq6uoMEwEAgOytwTuY2Usmk7jzAQDw+/hHMwYAAH4r+N9lAAAQCzIGAADEgowBAACxIGMAAEAsyBgAABALMgYAAMSCjAEAALEgYwAAQCzIGAAAEAsyBgAAxIKMAQAAsSBjAABALMgYAAAQy/8Aet50/xWOjdoAAAAASUVORK5CYII=)

Screenshot: bursa.com  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 7 May, 2020 22:35 GMT
Vulnerability Verified: 7 May, 2020 22:45 GMT
Website Operator Notified: 7 May, 2020 22:45 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 7 May, 2020 22:45 GMT