logo
DATABASE RESOURCES PRICING ABOUT US

citroen.mq Cross Site Scripting vulnerability

Description

Open Bug Bounty ID: OBB-1157767 Following coordinated and responsible vulnerability disclosure guidelines of the **[ISO 29147](<https://www.iso.org/standard/45170.html>)** standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence. Affected Website:| **[citroen.mq](<https://www.citroen.mq>) ** ---|--- Open Bug Bounty Program:| **Create your bounty program now**. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| **[XSS (Cross Site Scripting)](<https://www.owasp.org/index.php/Cross-site_Scripting_\(XSS\)>)** / CWE-79 CVSSv3 Score:| 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N] Disclosure Standard:| Coordinated Disclosure based on **[ISO 29147](<https://www.iso.org/standard/45170.html>)** guidelines Discovered and Reported by:| **ImPRINCE ** Remediation Guide:| **[OWASP XSS Prevention Cheat Sheet](<https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md>)** Export Vulnerability Data:| Bugzilla Vulnerability Data JIRA Vulnerability Data [ Configuration ] Mantis Vulnerability Data Splunk Vulnerability Data XML Vulnerability Data [ XSD ] Vulnerable URL: ![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQr0lEQVR4nO2dfUxT1xvHr1hqLRcqpa0KdQI6hotxDWEMN7Ys82WEMVI3RMfYxJf4shhGCG5I9tIxh0bL5tB0/DETZsi2GEMIMcSZSpaGMAaIlXWsVuZqqYUhCmhlBSr398f5/U7u7761vBQqez5/3XPuc5/znO+5t0/vue25CyiKIgAAAAAgAITMdQAAAADAvAVyDAAAABAoIMcAAAAAgQJyDAAAABAoIMcAAAAAgQJyDAAAABAogjfHxMXFXbt2ja8ITAcQM2iBoQHmGUGaY3777beJiYlnnnmGswhMBxAzaIGhAeYfPnLMrVu3wsPDOXcNDw8fPXqUrzhN6uvrs7Ky+IpzBUONme3yrBEkYgojcOLNY/DQDA4O7ty5U6lUxsTEfPjhh+Pj44EQhH4CB6fgp06diouLCwsLe+655y5fvjzX4QBTghLEbreTJOnPLgHLKZCSknLp0iW+4hzi8Xjw9sx2edYIHjGFoUv9LwEPTVZWVm5urtPptFqtaWlpJSUlgTjZGD6DTfDKysr4+PjGxsaBgYHz588rFIqmpqa5DgqYNMGYY1wu15IlS8bGxjiLwcPjmGOCVkwAD83IyIharXa73ai+tbV19erVs5Bjgo3o6OjGxkZcrKqqyszMnMN4gKnh1/OYr7/+Oi4uLioq6p133hkeHiYIYnh4ODY21u12L1iw4LvvvqMXv/zyy/Dw8BMnTixdujQyMnLHjh3//PMP8tPW1vbiiy+Gh4fHxMS8+eabf/zxB2dz9fX1mzdvDg0NZRS3bNly4sQJVHnt2rVFixahYAiC2Ldv36FDh4QNnnzySeHDGWE8evTo8OHDS5cuDQsL27p16927d+nzCewuHz16VKlULl++/MyZMwRBPHz4cN++fUqlcsWKFZ999tmjR4/QgaOjo7t37w4PD1+5cuWnn36K6pHnioqKuLi4yMjIt99+G8eGoduEhYVt27bt7t27hw4dUiqVUVFRO3fufPjwIbK8ffv2q6++GhYWtmrVqq+++ioyMpJTW3YHkQ07cuHwOP1wdpPvHGBXMqZuOMX0RzRMb2/va6+9Fh4eHhcXV1FRgTVpa2tbv3794sWLlUrl1q1bb9++jT0zBpTTUsAzpwIClwAemsWLF/f09ISFhaH67u7u6OhoRnf4zi7OseCMnHEJ0wWfvtoMfvrpJ7zNVmDbtm1ffPEFNli/fj36SHG5XGlpabh+165dp0+f9rNFIHjwnWPcbrfZbG5ubm5tbXW5XCUlJQRByGQyq9VKkqTH48nLy6MXt2zZ4na7W1tb29vb29vbOzo6jh8/jlxlZmbm5+c7HI6mpqa0tDSJRMLZIt/DmMzMTKPRiCovXLgwMTFx8eJFVDQajRkZGcIGWq1W+HBGGMePHzcajUaj0WazRUdHd3V10feyu2y1Wi0WS3V1NbowCgoKXC5XR0fHxYsX6+vrDQYDOrCsrGxkZKSzs/PixYsmk6mqqgrr3NnZiXR2OBylpaV8Y9HU1GQ2m10uV2Ji4sDAQGdnZ0tLi91ux4ccPHgwIiLCarVeunSpurqaT1u+DnJGLhAepx++bnKeAz5PDD4x/RENayIWi7u7u41G49mzZ3F9R0fH3r17+/r6LBaLWq0+ePAg9swYUD5LPs+cCgj0lPM52fXr14uLi/V6vZ+CcI4FZ+SMS3g6aitZYFdtbW0bNmzIz8/HNWwFcnJy6urq0N7e3l6z2azVat1ut0QiwV80CYIIDQ1duXIlz/ACQYzwbY7dbicI4v79+6jY3NwcHx+Pd3HOlaFDHA4Hqq+trU1OTqYo6t69eyKRiHPO1+FwxMbGom23202S5L1799hFl8sllUqRh5SUlKKiotzcXNRiRETE2NiYsIHD4RA+nBGVSqXq6OhgqCHQZRwzRVFer5ckyZs3b6JifX19amoq2lYoFHgaxGw2p6SksHVuamrCOjPGYmhoCNuEhISMjIzgoVm9ejVqWiKR0PVfsmQJp7bsDvJFLhwepx/ObnKeA5yVdKn5xPRHNOxBIpFgD3RN6HR3dy9btoziGlA+SwHPbAUELgHG0CCcTmd8fPyPP/7opyAUz1hwRs7wibenoLaTBUVRNpstJydHLpeXl5djHTgVGBkZQZcnRVEGgyErK4sRW3FxsUKhUCgUfOMLBDOTex5jt9vxJSTwgSuRSHB9V1eXSqVC29u3b9doNEVFRXq9/ueff8Y2Xq/X5XKh7dra2ldeeQXvYhQ1Gk1jY2NfX59arR4aGlKpVF6v99tvv33jjTf8MfB5OGZoaEgkEnm9XmE1cJcZ89oul0ssFuOizWZDF/a9e/cIglD8D7lcjsQR0FmgdboNLrpcLob+2IwuJmcH+SIXaJrTD183KZ5zgF1Jb5FPTIGoFDTYHuiadHR0bNy4MTo6GsWJ6jkfVHBa8nnmU4DvEmCc54jU1NTKykrcO5+C8I0pZ+QUT46ZgtqciEQirVaLvxJh+E4A1NONGzfW1NRQFOV0OvFpPDQ05HQ6W1pahFsEghPRbN4z/fDDD1euXLFYLC6Xq6io6Pnnnz916hRBEAsXLly+fDmyEf7VckZGhtFovHnzZmZmpkwm02g0JpOJPtMlbODzcAYLFy6cWQU8Hk9ISEh7e7tI9F/lQ0Jm7y9K7NmYmeogw49ANznPAXZlcXHxdOIxm81+Wmq12j179lRVVUkkEqfTmZ6ePn1Lgl8BvkuAPTS9vb2dnZ2//PKLnx3BsMd0UpFPAfrkGOLOnTtlZWV6vf69994rKytbtWoV3sWpQE5OzunTp/Py8lpbW2trawmCQJN44+PjoaGhMplMJpP19/dLpdKZjRyYDYRT0NTuYwjaXFldXR2aK2NgNpvVajWj0uv1KhQKfJ/OKFIU1dzcnJKSkpWV1dDQQFGUwWAoKChYtmwZvg0SNvB5OB2VSmU2m4XV4LuPEZjNIEmSPZsxg/cxjLmyuro6XM8Qk91BvsiFm+b0w9lNBpznAKr0c67Mz2/WSBO73Y6KeEarv79fJBLRm+a7j+Gz5PPsjwK4++yhQZX0Gv/nyhhjwRc5xXMfMwW1OefKKIoaGBgoLCwkSXL//v3CCng8HrlcfvLkSfqMQnR0NP1WT6/Xp6enc/oBgpmp5xi32y0SiWw2G6OIckx2drbT6bRYLBqNRqfTURTV1dWVnp6Ofu3ucDj27NlD/yUimqI1mUxr167FlYwiQqVSqVQqZO90OiMiIjQajf8GwnvpM8Xl5eUpKSmdnZ1Op/PgwYMmk4mhBr3L7KmVPXv2ZGVlORwOi8WSlJSEJz3279+fmpqKvscdP368rKxMWGcckp85hqIorVZL1x/Vs8Vkd5AvcuGmOf1wdpPzHOCsZLTIKeakZm+ys7O1Wq3dbrdYLOvWrcOWKpXKYDAMDQ3ZbDatViswV8ZpKeCZrQDfJcB5nlP/fzbev39fJBJZrVY0FcZ3dnGOBV/k9EuY3uXpq03Hbrfn5eWhbYEPgdzc3IiIiHPnzuED8f9j+vv7a2pq5HJ5c3OzPy0CQcXUcwxFUTqdTiqVVldX04sVFRUkSR47dkylUi1ZsuTdd99Fz6XHxsZ0Ol1CQoJYLFapVHl5eX19fYxWiouLS0tLsX9GEZGbm5udnY2LycnJDBthA4G9jM56vd4PPvhAoVBIJBKtVjswMMD+6KF3mRGn2+3eu3evQqFQq9U6nQ7Pkns8nsLCQrVaLZVKMzIy0BdGPp05v2kybNhFp9O5efNmqVQaHx+v1+tRPVtMdgf5IhdumtMPZzc5zwHOSnY6Z4s5qU+9vr6+zMxMkiRjY2OPHTuGLU0mU3JyskQiWbZsWVFRkUCO4bQU8MxWgO8S4DzP2d0pKSnBlxvf2cU5FnyRU7RLmN7l6avNh8CHQF1dHUmS+DcsiMrKytjYWLFYnJSURP+vDPAY4SPHTIHp/LErISGhpaWFrwhMAfxZAGJirFYr/g1CMHiGoQHmMbP6zN8n169fFygC0wHExJjN5vj4+ODxDEMDzGOCdN3lx51r164dOHCAb+/4+Phbb731999/z2ZI/3I+//zzM2fO3Llz59dffy0tLd2/f3/wewaAeQDkmICQn58fGxvLtzc0NFQsFk/z57nApHj55ZcNBoNarc7LyysoKNixY0fwewaAecACiqJm1uOtW7fWrl374MGDmfWp0WgGBwdn0OfMMjw8bDAYDh8+TBDE3bt3VSrVyMjIokWLCIIYHBwsKChoaGiQSCR5eXlHjhwJDQ29evVqRkZGb2/vXAcOAAAQQOA+ZmYYGhoqLy9H2263WyqVogRDEMSuXbsmJiY6OzuNRqPJZEJmcrnc7XbPWbgAAACzAuSYwDI6OnrhwgWDwRATE7NmzRq9Xn/u3Lm5DgoAAGCW8J1jJrvSu/9+UD3fkulogfrw8PCnnnrq+++/F/CM4mG/TYBzhXaf65YLLJvP1xBjmXR6bB6PZ2JiQiwWo6JEIhkZGWF3gb74OQAAwLzBd46Z7Ervk/JDCC6ZHhER0dXV1dDQQM8xnAuJ871NwP8l9/1cNp+zIYFl0mUyWVJSUmlp6fj4+IMHD3Q6XXJyMluc/Pz8DRs2XLlyxaeMAAAAjxPCf5+ZwkrvnP/BFFhhiQ5jyXTOBerZiyPxvU3A/yX3/Vw2n68hSvAP+V1dXRqNRiwWoxX90Mt02f9jLy8vl8vlOTk5eHkeAACAxx0f9zH9/f1jY2NxcXGomJiYiD5nSZLEb81Tq9VoJfMp+CEI4urVq5s2bYqJiVEqlSkpKR6PB9kTBLFixQpsj13FsCAIQiKR0I0dDgfaJkmS/hZIgTBIkpTJZLhHERERixcvRsXo6OiBgQG0zdeQAGvWrLl69Wp/f/+RI0eSk5M3bdrEtgkLCzt8+HB3d/fY2NjTTz/t0ycAAMBjwdw/89dqtS+99JLJZDKbzQ0NDT7tBV66F8xIpdKTJ09+8sknfAZ//vknWsSwrKxsNgMDAAAIHD7WklGpVGKx+K+//kLf/a1Wq8BfC6fg586dOy6X6+OPP0Zm+HZBpVIRBNHT04NuGmw2G3bFfjWI1+v1eDx04yeeeCJA3fGzITbV1dUKheL111/n3HvgwIGampq9e/fabLaoqKhJhQQAABC0+LiPWbhw4fbt2wsLC3t6en7//XedTpebm+uP39H/hyAITj9KpVIul3/zzTfDw8M3btzQ6XS43fT09KKiotu3byN77JlzrowgCLpxZmbmzHaHDmdDCoXC4/HcuHGDIIiQkBCv10s/5NGjR8eOHaP3wuv14rdXEQThdrstFktFRQUkGAAA5hU+n9hMdqV3/ISDTlVVFd9q5HwLj6MF6kmSTEhIwAvUc4LiYb9NgPPXB1NYt5yx0j67IQReJt3j8UgkEvqj+7NnzyYlJdHDOH/+/Lp163xpDwAA8Hgz82vJzD6BWL1mmg29//77Fovl8uXLnHtHR0cTExM/+uij3bt3z3SMAAAAQURwre0/b9Dr9QKvlF+0aFFNTc0LL7wwmyEBAADMPnP/u7J5SWho6LPPPitgAAkGAIB/A5BjAAAAgEAxH57HAAAAAMEJ3McAAAAAgQJyDAAAABAoIMcAAAAAgQJyDAAAABAoIMcAAAAAgQJyDAAAABAoIMcAAAAAgQJyDAAAABAoIMcAAAAAgQJyDAAAABAoIMcAAAAAgQJyDAAAABAoIMcAAAAAgQJyDAAAABAoIMcAAAAAgeI/zjj36SmEsaIAAAAASUVORK5CYII=) --- Research's Comment: ![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAfR0lEQVR4nO2df1ATZ/rAtxghhBAQIUWMAtaLyDEcKjLYouU6nerlcl5EtB6lxTsd9Rx/UEYdRKUc9WstakcROcbxOtphbK+jHMMwHOeklslxjINKIxcxIocaQ+Q0UKCRBkT2+8c7fWdvf7zZQBasfT5/Zd99932f53nf3Sf77u7zvETTNAUAAAAAEuA32QIAAAAALyzgYwAAAACpAB8DAAAASAX4GAAAAEAqwMcAAAAAUgE+BgAAAJAK8DEAAACAVICPAQAAAKRClI85efLkK6+8EhAQsGDBgr///e+SCtTf3//RRx9RFHX//v3g4OCxNfKPf/wjJCSkp6cHl7z22mv79u2jKOq7777buXNndHR0YGDgvHnzPv7442fPnqE6hF0YrlT379+fNm0a/v0Sg1mzZu3du/fp06di1BmDvqi7f//736zyv/71r1gk8U3h3oV+ixeJxYkTJ8Y8mu+//35gYOC5c+fGcOzEg9Vk6UtQHys4tgng7UB75Ny5c/Pnzw8MDJw/f/7Jkyd92zgB3rOPZRN8cQB+TNCeKC0tjYmJMRqNjx49On/+fFhYmMlk8njUmLl3755SqWT+GBs6nW7Hjh3od1VVVVRUlMvlomk6MzPTYDBYrdZHjx4Zjcb09PTm5mZUjbCLKx6zJDQ0lLnX7Xa73e7BwcHW1tbU1NT9+/eLVMftdnul47179yiKWr9+Pas8NTUViyQe3DtTVG9HgWkBzMjICO29djRNO51OPz8/s9mMWvhRgNRk2U3IjCwFxzABxjDQBE6fPq3RaGpra51OZ0NDw9y5c4uLi33YPgGhs49pk3FeE4BJwbOPiYqKunz5Mt48fvy4Xq+XTiBf+Rir1apQKDo7O0dGRrRa7dmzZ2maHhwclMlkfX193PqEXbziMUtYPoa5t7GxMS4ubvzqCAkjk8kUCoXD4cCFTU1Ncrl8PJee8fuYMXctaWsTiUgfM04Ffe5jNBrNpUuX8GZLS4tCoUB/ziRlzGcf8PzjYa2sv7/f4XCkpaXhkmXLlrW1tVE/3P4fOXLk5ZdfnjZtWk5Ozvfff4/qDA0NbdiwITg4ODo6+oMPPkArTqj+sWPHYmNjp02b9s477/T393O7i4mJcblcL7300sWLFymKOnHiRGxs7PTp0999911mfd4umMybN2/Tpk35+fmnT59WqVQ5OTkURY2OjlIUJZPJuJoSdo0HuVzudrvF1OSuUJFthdvX6/VlZWW45Pjx41lZWXjzyZMnmzdvjoiImDVr1p/+9CdsKNZylsiFmqtXry5ZsiQwMDAiImLNmjVdXV1iVOPV7qOPPoqIiJgxY8Zf/vIXim9Ae3p68GRAa2VcXe7evRsUFPTNN99QFNXT0zNt2rSvv/6a2e+pU6eWL1+ON/ft24dmArcp7uoWdxlq1apVR44cQb9v3LgREBCAx2Xz5s27d+/2ar2LpSBrnU1o9Lu6upYvXx4cHDxv3rzz589zm+UdI5Fnn91uT09PxyULFixoaGigBIZMaGpdvXp16dKlwcHBM2fOXL169a1bt4QKMUJnH9OezIsDmg8eLwLA84AHH+NyueRy+dSpU3GJSqUaGBjAe5ubm69du3bt2rWWlpaSkhJUXlxcjFaK6uvrTSZTRUUFrt/a2trU1NTc3Gyz2QoKCljdhYSEWK1WtNiyatUql8tlNptRfYfDkZ+fj2sKdcGksLDw8uXLBQUFpaWlqCQoKEin061bt+5f//rXkydPmJUJu8ZMf39/UVGRTqcbw7EebYXZtWtXRUUFcvAPHjyor6/funUr3rtjxw6Hw9HS0lJfX19TU1NeXo7K8ULWnj171q1bJ1KqlpaWTZs2dXd3WywWjUazbdu2MaiGtLNarRaL5ezZs+gfDHdAp0+fjidDdnY2ry6xsbEFBQW5ubkURRUWFup0ul/+8pfMjgwGg8lk+u6779BmTU1NRkYGwSxk9Hq90WhEv2tra0dHR+vr69Gm0Wj0dqC5CjLtIzT627ZtU6lUbW1tdXV1vD5GaIw8zijuyU5R1OLFi4OCgii+IROyoV6vX79+vc1ma2xsTEtLk8vlQoUYMWcf8+KAzCXmIgBMPuTbHO7NaWdnJ7o9Rw8DbDYbKq+qqkpOTka/w8PD8f212WxOSUnB9QcGBlB5Y2PjnDlzCD2y6jc1NTHr83bBZd26dbNnz2aWDAwM5Ofna7VamUw2d+7coqIivNZP2EUwCGutjKKo8B/w9/fPyspCcnq8zWetUHllq2XLlpWVldE0vWfPnk2bNmGRRkZGlEplZ2cnql9TU5OamspswWKxzJ492+l0Cq2PEcTu6OiIjIzkisS0QHh4+LZt23i16+3tZR4oNGfwUUK6DA8Px8XFFRUVhYeHd3d3c+VMTU29cOECbg09H+I2xV3d4i5DORwOhUKBnhCkpKTk5eVlZWWhyiqVanh4WGilV8xamdDMZ47+yMiIXC5nnnTktTI8RmJmFGGsuUMmNBy9vb0ymYz1YIm3kAXv2Uc2o8iLADC5ePAxdrtdLpczSzo6OsLDw2mavnfvHnNXW1ubWq2mabq3t5d5lQkLC0PlYs5h+n/PNKH6Ql2waG1tDQ0NTUhIqKio4O51u91NTU34mbzIXR59jEKhsNvtdrv97NmzkZGRg4ODQgcSWvbWVjU1NXPnzh0YGAgLC7Narbi+w+Hw9/fH9dvb21le4dVXX62urib0zpKkpaXlzTffjIqKQmbnSsW0AAJdmMh+S8ycIeiC7i1KS0t5DXv48GH0WkRZWdnatWuFmhJp86SkpMuXL3d3d2s0mr6+PrVaPTIycubMmYyMDJo4e73yMUKSOBwO1knHFZJ3jMRoxz3ZCfIThmPdunVJSUl5eXlHjx5taGggFPLCPPsIZhR5EQAmHQ9rZeh/H3r7FjEwMKBSqQiHuN1uPz+/a9eumc1ms9nc2tpqNpu9urXyiMguduzYkZeXV1ZWtn///m+//Za1NyAgYMmSJaWlpV9++aX4XehvLHPl1+VyKRQKvOnn5zdz5syZM2fm5OSEh4efOXNmXKqK4ze/+Y1MJlu7dm1qauq8efNEHnXq1Kk5c+b89re/Fd+RwWBYtmyZyWQym811dXW8dbAFEGJerh3nnOnu7vbz8+vu7ubdm5GRgUStra1FC2XjQafTGY3G2tpavV4fEhKSlJRkMpnGsFAmHWLGiBfuyU5R1PXr171dOv7888/PnDmTmJg4PDycl5e3fft2oUJeCGcfkwm4zgA+wYOPCQkJiYqKamxsxCWNjY3x8fHot9vtfvDgAfrd3t4+e/ZsiqJmzJihUCh6e3vxVWbGjBm+FVpMFxcvXuzs7Ny1a9frr7+elpZWWFiIylknDFo58bgLExERERYWduXKFVxiMpkSExN55dy/f39JScnQ0JD3KnpNXl5efX19Xl4es1CtVvv7+9+9exdtWq3WmJgY9Lurq6usrAw/qRLD48ePHQ7HgQMHXnnllZkzZ7KW1MeDmAEV0qW/v3/Xrl3nz5+vqKhgPUlG/OxnP1Or1V999dWVK1eQJ+BtKiwsbHBwED+5sdvtvKKiRzI1NTUrV66kKMpgMFRXVzc0NEyMj1Gr1RRFMU86VoXxjFFISIhGozGZTLjk5s2by5YtE5JEaGpRFLVo0aKcnJy9e/d++umn1dXVhEKMmLOPyQRcZwDf4PFOB38f43Q6v/jiC/x9DFqizczMtNvtFoslKSmpqKgIHbJly5bU1FSLxeJwOEpKStAr9iLXIlwul0wma29vJ9fn7QIzODgYExNTWVmJNtvb2xUKRWtrq9VqVavVp0+fdjgcfX19JpMpISHh0KFDNE0TdrEoKyvTarUmk8npdF64cCEsLKyxsRELyVpSiI+PRyt1hA9HuMd6u1ZG07Tb7cavmDPrb9y4ceXKlTabzWKxLFy4EC8oZWRkXLhwAUvCbGpgYEAmk1mt1pGREeZvmqbVanV5eXlfX197e7vBYOBdKxO/KMREzJzh1WXr1q1oBezgwYPp6encrmmaLiwsTExMZL5zz9tUSkrKxo0bu7u729vb09LShB51qNVqtVqNni7Y7XaVSpWUlMRSjWU31ibZLOTRNxgMzJOOKyTvGImcUczvY0wmU3x8/MGDB7mHE2zY1ta2YsWKy5cvO51Om822ceNGvV7PW8hsSujsY/WLLw5ok3wRAJ4TPPsYmqZLS0vnzJnj7++flJRUV1eHCtHwHz58WK1Wh4aGvvfee/jZg9vtzs3N1Wg0CoVCp9OhB4MiZzlN00VFRQqF4tixY4T6vF1giouLWQ8Ac3Nz0QWorq4uPT1dpVIpFIrExMTTp0/jOoRdLD755JOYmBh/f/+EhISqqiqmkKxTsbKyMiYmBj0N5jp45oOicfoYVjmu73K5Nm3aFB4ertFomG8xsCRhNZWfn69QKNBHRczfJpMpOTlZLpdHRkbm5eX50MeImTNcXa5du6ZUKtEzcLfbHRMT89lnn3F7R6soSAWCWTo6Ot544w2lUhkfH19aWio0P7OysjIzM/FmcnJyQUEBVzWm3bibBLOQR99ut7/11ltKpVKr1R49epQrJO8YiT/7zp49GxcXJ5fLtVot/kfCO2S8NhweHi4qKtJqtf7+/mq1Ojs7u7u7m7eQ1Rrv2cftF10ckBnJFwHgOeElmnO5Ecn9+/cTEhLw2gIAPLc8efIkPDzc4XD4PPIKAABkICYm8OJz6dKltLQ0cDAAMPG8sD7mxo0bf/zjH33e7NOnT3/3u9/997//9XnLgET09/ejt5YnWxAA+CnywvqY9evXM1908RVTp0719/fftWuXz1sGJAI/L5xsQQDgp4hnHyMU8T46OlrMwxgxEZyYIbvHE9If09PT09raikKM+DzOf25uLg4oAjz/DA0NXbx4MSAgYLIFAYCfIp59zB/+8AebzXbp0iWbzVZeXl5fX9/S0iK+g+joaKfTSa7T19d36NAh8fU9gr6LRJeV5cuXp6WlFRcXo11/+9vf7t27h4I1EVQj7AoLC3O5XOOUEAAA4KeAh/fKvv/+e5VK5XQ6Q0JCpBPC56+osRq8ffv2woULUWyu+Pj4goICFCVaSDWy1vBCHQAAgEg83McQIt4/e/Zs7969L7/8clBQ0Jo1a9BiFDcGOCtiOTcXACtkt8gI5w8fPvz1r38dHBwcGxt77Ngx8itDExDnn5DpQCiMPG9loZaZm0hZrxoBAACYFDz4GELM7ZKSEqPRaDQa29vbo6KiUFIZii8GOIY3FwA3ZDezPiHCub+/f0dHh9Fo/OyzzzzqOQFx/oUyHfCGQBeq7BU+aQQAAEBCPH6lKRTxXq1Wt7S0sCpzY4CzIpbz5gIYW4Rz/FkvN8I572fJvorzz9u4kHZCYeSFTMFF6AttrxoBAACYFETFkkEwY2739fXJZDKR6VWwz+DNBUB7H1GDFVecG+GcK4YP4/wL+Rhe7YTCyAuZgpl5hbc7po8RagQAAOA5wYvvY7gxt6dMmeK7GyppkSLOvxSYGUxAdwAAAJLi2cfwxtwOCQkJCwu7ceOGV53x5gIYA2q12s/P7/79+2jTarWS60sU558Fr3ZCIdCFTMHMvIJKCDHnfWVPAAAAqSDf5hAi3h86dCglJaW1tdVut2/btg0H/CeslVECuQCYIbtFRp/NzMw0GAz37t2zWCyJiYmstTKbzYbXkXwe57+jo4M33rCQdtwQ6ITKvPDGnCc0Qk5qCwAAMGF4fh4jFPF+ZGRkz5494eHhcrncYDA4nU7ak48RygVAM0J2i/Qx3d3der1eqVTGxMQcPnyYddF3u91yuRw5LZ/H+b9w4UJiYiLLSgTtuCHQyabgwhtzXqgRoej6AAAAE8/YY/t7i3SfLt6+fXvZsmWsOJU7d+60WCxfffWVb/saGhqKi4vbv3//hg0bmOVeaecTU8CnoAAAPP948Znhc4vZbJ4zZw6r8OjRo1I8Ng8ICKisrHzttdd83jIAAMCLx4/Vx3z44YdRUVErV67s7OwsKCjAj/ExU6dOXbx4sRRdg4MBAAAQyY81tn96enp5eblGo8nOzt6xYwcKDwMAAAA8V4j1MY8fP546deo///lPbzvA8bVwLgDe6P3ehvRfunTp9evXh4aG7ty5s3PnTq9Eev/99wMDA8+dO+fVUWSYmQ6wymIq+6RHAufOnZs/f35gYOD8+fNPnjyJy+/fv/8Sg1mzZu3du/fp06d4Lx6Ol/jgjpdQRwje+eOTPA4SteZtL6w4e7z1fZ7D4gXDK5uwKjNtCzxfiHw3AL3OtGXLFm9fKmC9D4bgvlw7YW9DOZ1OPz8/s9nMDVLgK3hVnhROnz6t0Whqa2udTmdDQ8PcuXOLi4vRLmRwt9vtdrsHBwdbW1uFYhmgOlarNTQ01P0DrPEidITgnT++HfSJmUKEXtCs5lbAs521C14xZ+HtCDINCK9TPreI9TGpqamVlZWRkZHDw8NedSDygjthU2QCOnp+fIxGo7l06RLebGlpUSgULpeL5rNDY2NjXFwc+s37DjpTKVYFQkcI3vnzgvkYjxXgOkhmPPYB2z63iFor+89//mO32995552FCxfW1dVRngLvd3V1LV++PDg4eN68eefPn2e1RrgjPnHiRGxs7PTp0999911mg1evXl2yZElgYGBERMSaNWu6urrefvvt//u//8MVlixZgta+hoaGNmzYEBwcHB0d/cEHH+DklYienh5mHgFKOPA+U1q88EXQmqwy69igoKC33367p6dn9+7dERER06dP//3vf48jCwiJxMyY4FFTiqL6+/vtdnt6ejouWbBgQUNDA6/lKYqSy+Vut1toLwGPHXHnj0h4R5kwQMxCoZHitRuvhbmzDrf/8ccfs1IqeFxDE8phISQSEmDp0qXBwcEzZ85cvXr1rVu3WI1zpwpZd8ypU6eWL1+ON/ft25eTk0NojWttXothVq1adeTIEfT7xo0bAQEBWIbNmzfv3r2bMHu5tuU1BWsRknVe87bv0Z6AFIjyMZWVlVlZWRRFZWdn4wsoOfC+SqVqa2urq6vjveDy4nK5zGYzatDhcOTn5+NdLS0tmzZt6u7utlgsGo1m27Zta9eura6uRnsfPnxoNpsNBgNFUcXFxWjlp76+3mQyVVRUMLuYPn06K48Ab+B9spC8WotRGSnY2NhoNpsdDkdcXJzT6Wxtbb1y5QpOzSkkEjdjAllTdIhcLp86dSqzcPHixUFBQVzZ+vv7i4qKdDodWX0hvcgd8c4fMQiNskipeEdKyG5cC3NnHa557QfEp1Qg5LAQEkmv169fv95mszU2NqalpcnlclabQrOXcG4iDAaDyWTCz/NqamoyMjLGcC4IZfHQ6/U4H3ltbe3o6Gh9fT3aNBqNOp2OMAq8tiWbgmtb3vY92hOQBDE3O1qt1mKx0DQ9ODioVqsHBgY8Bt5nxpwXE3if1WBTUxNukEVHR0dkZOTg4KBKpUK9lJeXr1y5Eu0NDw/HSzRms5n1hT+rd6HA+0LxBYS09qgyPravrw8f6+fnhz/vb2pqmjt3LkEk6n8zJnirKRfUJo7x7O/vn5WVhRv0aq3M4zIFd/6IPJB3lAmBqJkiCc1PXrvxWpgJmnW4JjelAiE+Ba+hmL95Rert7ZXJZIRnNrxThaw7k9TU1AsXLmBJBgcHhVojpJYQspjD4VAoFEj4lJSUvLy8rKwsdJRKpRoeHiaMAte2vKYg2JnXpB7tCUiE5+9jrl69qlQqf/7zn1MUFRgYuGLFiqqqqvT0dKVSie9VNRpNb28v+v3o0SOKombNmoU24+LiRHo7ZoNRUVG4QYqivvnmmz179rS1tQ0PD4+Ojo6OjgYGBup0uurq6u3bt1dVVa1fv56iqG+//dbpdKKgkxRFjY6OknNZPnr0aHh4ODY2FouKZrlIIbHWIlVWKpU4ebNGo1GpVIGBgVhfp9NJEEmpVDJXhMRoipIvEHRRKBToM1Wj0Zifn3/mzBksj1eQO+KdPyLfNecdZZHwjhTBbiwLU3yzDpXL5XLmWNtsNvFScRESadq0aZmZmampqW+88UZUVFRycvLrr7/OPJAwe4XOTSYGg6G2tnb16tW1tbU6na6vr28M54LQ+5MzZszQarVNTU3x8fEOh6OwsFCr1T579sxoNL755psul0toFHht69EULHhN6m0jgK/w7GMqKyvb2toiIiLQptvtdjgczMX3CcBgMGzcuLGiokIul9vt9hUrVlAUtXbt2rKysuzs7Obm5qqqKiSbn5/ftWvX8JT18/uxfgBERoymaOng6dOnzFWs69evx8XFoVUsPz8/FN05Jyfn6NGjZ86c2b59+xiEIXfEO3/Ef8/EHeXx4NUM4Z11Pocg0ueff379+nWLxeJwOPLy8l599VXuS+FjJiMjAy1w1dbWeuW8RaLT6YxGY2dnp16vDwkJSUpKMplMaKFsDOcp1xS7du0SqizUvqT2BAQh3+aMjIxERkY2Nzfbf8Bms4WGhjY3NwstKLEWjqqrq0WulQk1+OjRI5lMhneZzWa0y+12h4WFHT9+PCMjA+9VKpXc7JxCHfGuNgwMDPj5+TGXGphrZbxCelSZrCCrKY/LdyI1pWlao9EYjUa8abFYhN4r++KLLzQajdBbtrwCs94r4+1IaP44HA7eXrhwR1logAjLd0zhee3GlURo1rHWc6qrq8e/ViZmKM1ms0ajYZYQ1soIM41JQkKC0WgMDQ0dGBgQak2MtXlpampKSUlZuXJlXV0dTdPl5eU7duyIjIxEQy80Cry25TUFea3Mo0m59gQkwoOPqa+vj4+PZxVmZmYeOHCAMI8NBgMz5vw4fQxN02q1ury8vK+vr7293WAw4F1ZWVkqlerLL7/ENbds2ZKamor+qpSUlLC+0uB2xA28TwvE0icLSVbZo4LMTd5cAFyLedSU/t/PVkwmU3x8/MGDB3nloWk6Pj4eJwn11scIdSQ0fz755BPciPt/4X63xB1l3gEaGBiQyWRWqxVHtuYVntduvBbmnXX3BFIq4BaYYrBa5s1hISRSW1vbihUrLl++7HQ6bTbbxo0b9Xo9S0Le2SvexxQWFiYmJuJmeVsTsraY/wdqtVqtVqM/Lna7XaVSJSUlkUeB17a8pmAJwLQtb/ti7AlIgQcf89577+3Zs4dV+OmnnyYkJBDmsd1uf+utt5RKpVarPXr06Ph9jMlkSk5OlsvlkZGReXl5eFd1dTV6XIlrut3u3NxcjUajUCh0Oh3+XybUETfwPi0QS58sJFlljwoyN4VyAbAa9Kgp4uzZs3FxcXK5XKvV4qsGVx6apisrK2NiYtD3K976GKGOhObPwoUL6R+uKSy4ybC5oyw0QPn5+awMEVzhee3Ga2HeWYdqlpSUEFIqYDG4LXNzWAiJNDw8XFRUpNVq/f391Wp1dnZ2d3c3S0Le2Svex6CncUhOodaErC3Gx2RlZWVmZuLN5OTkgoICj6PAtS2vKbgCYNvyti/GnoAUTFxsfwAAniuePHkSHh7ucDjIoY8AYDy8mI/EAQDwyKVLl9LS0sDBAJICPgYAfor09/eXlZWtXbt2sgUBXnDAxwDATxH8zGOyBQFecOB5DAAAACAVEt7HMIPWTUy2DCkSw0wYHrPOiMmQIZTFBAAAYFKQ0MdER0ej+CgTQ09PT2lp6ZUrV1gBB18Y+vr6Dh06RK4zwTYHAAAg4zmWzHgICAiQtH0mLpdLoVD84he/mLAen08m0uYAAABkPNzHiM96wk22IWa5Rnz7XiWGIWTCEMp4MfH5XSjhrDPcY7kZMnizmxBsDskzAACYeDyvlYnMeiKUbMNX7XuVGIaQV0Mo44V4SXyV34USzjrDPZabIcNbg0PyDAAAJgFyGACRWU9YoGQbYlKMiG9ffLoUcl4NoYwXIiXxYX4XQtYZoewaQtE7mNlNeCMzQvIMAAAmBc/PY8RkPaGEk234pH2vEsOQ82oQ3t2a4PwuQllnRCrrlcEheQYAAJOCz575S5ps40eXGGY8Aos81luDQ/IMAAAmHt/4mMePHzscjgMHDqBNn78+O2PGDIVC0dvbu2DBAo+V1Wq1v7//3bt30d2G1WrF9wTjR2TjYgRWq9UURT148ADdyrS3t4s/dmwGX7Ro0aJFiyiK0ul0er0efAwAAFLjm7uBiIiIsLCwP//5z/39/Xfu3CkqKmJVCAsLc7vdt2/f5n29SgzZ2dlbt269efPmw4cPjxw58uGHHwrVnDJlyrp163Jzcx88eHDz5s2ioqKsrKyxdTqexj0KPGXKlBUrVuTl5XV1daGmyMeGh4e73e47d+5Q3hv81q1bv/rVr77++uuenp4HDx6UlZUlJSX5yiYAAACCkB/XiM96wk22wTqWmVRjDO17lRhGTF6NMWvqw/wuQllnhI5lZsggZDdBlZkGh+QZAABMChCvDAAAAJCK5/rJOQAAAPCjBnwMAAAAIBXgYwAAAACpAB8DAAAASAX4GAAAAEAqwMcAAAAAUgE+BgAAAJAK8DEAAACAVICPAQAAAKQCfAwAAAAgFeBjAAAAAKkAHwMAAABIBfgYAAAAQCrAxwAAAABSAT4GAAAAkArwMQAAAIBUgI8BAAAApAJ8DAAAACAV4GMAAAAAqQAfAwAAAEgF+BgAAABAKsDHAAAAAFIBPgYAAACQCvAxAAAAgFSAjwEAAACkAnwMAAAAIBXgYwAAAACpAB8DAAAASMX/A4O+dHIfVbaWAAAAAElFTkSuQmCC) --- **Screenshot:** ![citroen.mq vulnerability](/twimages/screen-1157767.jpg) **Mirror:** [Click here to view the mirror](<http://1157767.openbounty.org/mirror/>) ### Coordinated Disclosure Timeline Vulnerability Reported:| 8 May, 2020 13:49 GMT ---|--- Vulnerability Verified:| 8 May, 2020 14:01 GMT Website Operator Notified:| 8 May, 2020 14:01 GMT a. Using the ISO 29147 guidelines| ![](/images/done.png) ---|--- b. Using publicly available security contacts| ![](/images/done.png) c. Using Open Bug Bounty notification framework| ![](/images/done.png) d. Using security contacts provided by the researcher| ![](/images/done.png) Public Report Published [without any technical details]:| 8 May, 2020 14:01 GMT