allmarks123.com Open Redirect vulnerability

2020-05-0916:06:00

hacker22385

www.openbugbounty.org

JSON

Open Bug Bounty ID: OBB-1158123

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	allmarks123.com
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	Open Redirect / CWE-601
CVSSv3 Score:	3.4 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	hacker22385
Remediation Guide:	OWASP Open Redirect Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQSElEQVR4nO2df0xT1xfAn1CgwOOXlPKrhB9RRohxxLCGLeAcIcq6hlSGkyFDjUQIYYwRcA4M6xxRhrI4xghZtkTJ4vhjcY4QQkznEkYYYQxrV1ghBKHWyhAQWMFSCu/7x81e3vf1vdfHjwrC+fzVe9+7551zz7k9vaflsosgCAwAAAAAHIDTZisAAAAAbFsgxwAAAACOAnIMAAAA4CggxwAAAACOAnIMAAAA4CggxwAAAACOYkvkmMjIyPv377M1gRca8Ob2BhYvwM3m55i//vprZWXl5ZdfZmwCLzTgze0NLF7ALnZyzNjYmJeXF+Ol2dnZy5cvszX509LSkpaWxtbcLKiGc0zCxj6IP4uLi++++y514JMnT06cOOHv7x8aGvrhhx8uLi6i/sHBwTfffNPHxycwMPDMmTOzs7MbpjoP1unNsbExPz8/bENdsOZAXQ9Pnz49ffp0QEBAaGjoRx99tLS0xH8sH9ufwzplZFMW7wYGg0OXNmJT4m1LsfZ9zMzMzKVLl9ia/NmaOWYrs7i4mJqaarVaqZ05OTlCoVCr1XZ0dGg0mgsXLqB+mUwmkUh0Ol1fX5/ZbM7Pz3+eqm6UN8PDwycnJ9cvB1tHoK6HU6dOWSwWtVp99+7drq6uysrK5/bojVqnjMDitcumxNvWguBkdHQUx3E+lzju5MBoNPr6+losFsbmJkI1Z22mreFB/IdUVVVRB5pMJqFQaDKZULOnp2fPnj0EQZjN5mvXrs3NzaF+jUYjkUg2Tnc7rN+bo6Ojvr6+G6gS4WBvMrKwsCCRSGy9wxM+Cjt6nTKyWYt3A014DsHw/ONtq8FrH/Pll19GRkb6+/u/9957qNgyOzsbERFhMpl27dp148YNavOLL77w8vK6cuVKYGCgn5/fyZMnnz17xia5paXl8OHDLi4utObRo0evXLmCOu/fv+/m5kYWefLy8vbu3ctxtaysjHt4WVkZVYc//vjj1VdfdXd3DwgIOHbs2KNHjzimAm2ua2trIyMjPT09jx8/PjU1VVZWFhAQ4O/vf/r06fn5eQ6xaPjly5cDAgKCg4O/++47qvD+/n5/f//ffvuNlJCUlOTl5RUaGvr222///fffqD88PLyiooI60NPT89mzZ56enqhpsVhcXV0xDHNzc/vggw9QNWBpaen7779PTk6mWbS8vPzxxx8HBgZ6enoeO3ZsamoK9c/Pz+fl5QUEBISFhX366afLy8urMp/qTUarFxcXz5w54+XlFR4e/sknnyD5GIY9evToyJEjXl5eL7300s2bN6nTzjaBbKJsTaPFLW0qGF3G6AWkhm2QP3jwwNPT8969exiGTU1N+fn5/frrr+7u7g8fPiS9Mzw8HBISQqvS0KqCbBHCzarW6Y0bN9isYLOaBtviZYsfjscxepAabH5+fidOnKBWej///HOaHLYpRTx+/Pitt97y8vKKjIysra2lXrIVxaE/o3w2VbnjbYdgP8eYTCa1Wt3V1dXT02M0Gs+fP49hmI+Pj06nw3HcbDZnZ2dTm0ePHjWZTD09Pb29vb29vX19fTU1NWzC2fbacrlcpVKhztbW1pWVlfb2dtRUqVQKhYLjqkwm4x4uk8moOvT19Z09e3Z8fFyr1UokksLCQj4T0tnZqVarjUZjTEzM5OSkRqPp7u4eHR0tLy/nFmsymXQ6nVarvX79emJiIil2dnY2PT29uro6KSkJ9cjl8lOnTun1+s7OzsTERKFQyK0YSVVVVU5ODrXnp59+8vDw6Onp+eabb2g319TUqFQqlUo1NDQUEhIyMDCA+ouKioxGY19fX3t7e0tLS0NDw6rMx/7fubZWX7x4cWFhQaPRtLe3d3R0NDY2ojsLCwu9vb0HBgba2trIHEObf56ibE2jxS1NMqPL2LzAGOSRkZHl5eXFxcUYhlVWVspksjfeeIP6iMHBwdLS0qtXr3K4jy1CEAE2UP3Cf50i89mWKp/Y4y6UMcYP2+PYPGgymTQaDTJKr9eT0WUymXr/g/sdhqSwsNDV1XV4eFilUjU1NVFnm1EUW/yzwagqd7ztFLi3OaOjoxiGkcWWrq6uqKgo8hLjHhwN0ev1qP/WrVvx8fHotV6vj4iIIIeYTCYcx6enp22bRqPRw8PDbDYTBCGVSktKSrKyspBwb29vvV7PcdVisXAP59jODw8PBwUFEey1MmTdzMwManZ2djo5OS0sLJDzw1gGoYrFMIw0mSpcJpMVFBSQ/dPT0wKBAJnACNseXKlUpqSkWK1WaufCwkJHR8e+ffsaGxtp94vF4r6+Plqn1WrFcXxkZAQ1W1paEhISVmU+1Zu2VhMEIRKJyPKRWq2WSqXouUKhkBo8qFZGiy4+othM41m7QC5j8wJHkFsslpiYGKVSKRKJxsfHqaMMBkNUVFRzc7OtGmRVkCNCSCE0iDWtUw4r2Kymrl+OxUuwxA/HpDF6kGZUZ2cnMopNDtuUEv/FFakPNa4YRbHpzyafTVVbrXYgArtJCMdxcocYEhIyPT1td4hQKAwLC0OvY2Ji9Ho9Obyrq4u87c6dO1KplNxvUpvBwcHR0dFdXV2xsbFGo7GysjI6Onp5eVmlUqWkpISFhXFcdXFx4R5ObucR9+7dO3fu3MDAgMViWVlZWVlZsTshPj4+6LVEIvH29nZ3dycNJL+aZhOL4zh1n46oqKhob2//9ttvyR4/P7+MjIyEhITk5OSQkJD4+PjXX3/d7sz//PPPTU1NPT09zs7O1H53d/ekpKSampoLFy7k5eWR/bOzs9PT0/v376fJmZiYsFgskZGRqBkTE4NWEX/zac6lWf306dPJycmIiAjUXFlZEQgE6LkYhlGDx9ZGnqLYTOPA1mUcXmALchcXl/r6+pSUlLq6usDAQKr8jIyM4uLi48ePc6vBGCEkoaGhbKNWu07ZrGCzmrp+ORYvxh4/jI9j8yDNKIlEQhrFNvlsTExMrKysUPXhngGO+GeDTVXAfo7ZQJydnYODg8km915bJpOpVKqRkRG5XO7j4xMXF9fR0UFWuriv8rmBRKFQ5ObmNjY2CoVCg8GQmpq6IcbyF7uwsHDr1q3m5ubCwsL09HTyHfyHH374888/tVqt0WgsKSl57bXXvvrqK44n9vf35+fnt7e3+/v7o56lpSW1Wv3KK6+gZlRUlNFotB1IS0gbAvdPjMxms5OTU29vL/lu4uS0xp84cotalWmMLlutFzAMGx8fd3JyGh8fp3Y+fvxYo9H8/vvv/PVhhCyOkTx58mSdMm1htJq6fjfwF2UbGAzAVoR7m8O9PeRTK7t9+za5I6ZitVpFIhG5G6U1CYLo6uqSSqVpaWltbW0EQTQ0NBQVFQUFBRmNRrtX+dyAmJiYEAgEZFOtVtOKMxyvaRNCbfIRSw4RCAQDAwMEQcjl8sLCQtu5QhJoPwmjiZqent6zZ8/Nmzep95jNZoFAQFYwWlpayDoSiVgsVqvVtE6OWhkf82neZCwX4DjOWKOj1spu375tWyvjKYrNNLbaBZvLqJBe4AjymZmZoKCg5ubm3bt3I7eSplHDe25uzsnJiVpd4YgQPrWy1a5TbisYrabawr14+dTKqI9j9CB3OdFWDtuUEv/F1ejoKGqy1cpIUYz6c8jnP/87kLXnGJPJJBAIhoaGaE3ktoyMDIPBoNVq4+LilEolKYEs8qKvB8h+WhMhFovFYjEaYjAYvL294+LieF61ewOpiVgsbmhomJmZGRoaUigUyMC5uTmBQKDT6axWK/U1zzdZNrHc7yA6nU4oFGo0GoIgBgYGUlNT7969Ozk5qdfrc3Nz5XI520Cr1ZqSklJUVGSmgC7J5fLMzEyDwaBWq2NjYxsaGmjmX7p0SSqVajQag8FQWFjY0dGB+nNzc9PS0vR6vVarPXDgQF1dna3+bObTvMm4zPLz8xMSEtAn5ZqamosXL6J+hUJBDR4+OYZNFKNptLilfutg6zI2L3AEeUFBwTvvvEMQRFVV1aFDh6h60r7hkEqlubm54+PjQ0NDiYmJbBFCDT+ChTWsUw4rOGIPmcBn8drGD8ekMXqQO8cwymGcUkRGRoZCoRgdHdVqtfv377crijH+2eTzn/8dyNpzDEEQSqXSw8Pj+vXr1GZtbS2O49XV1WKx2NfXNycnh/xOmCqttLS0vLycFEVrIrKysjIyMshmfHw89R7uq9w3UDXp6OiIj48XCoVBQUElJSWkgefPnyetI1/zzzGMYu1+Si0qKjp48CBBEBaLRalURkdHu7q6isXi7Oxs2hfIth9IqZBqTExMZGZm+vr6SiSSqqoq27FWq/XcuXMikUgoFCoUisnJSdRvMpnOnj0rEokkEolSqURvcDzNp3mTMTGYzebi4mKJROLh4SGTycjPjAaD4fDhwziOR0dHX716lU+OYRPFZhoZtzRpti5j8wIaaBvkvb29OI6jz8VmszkiIqKpqYlxrgiCGB4eTk5OxnE8Nja2rq6OLUKI/w9FRtawTknzba3gttrWv4yL1zZ+2B7H5kGOHIPjeE1Nja0cxilFjI+Py+VyHMcjIiKqq6vtimKMfzb5q5r/nYadHLMGeO4No6Oju7u72ZrAC8229+b2KICs2Yq1Ld6tM2k6nU4sFm+2FjuF5/qdP5XBwUGOJvBCA97c3rzoi1etVkdFRW22FjuFTcsxAAAAz43PPvssJCQkLS1tZGSkvLz8eR4Zt8OB3wgCALD9OXToUENDg0Qiyc7OLioqOnny5GZrtFPYRRDEZusAAAAAbE9gHwMAAAA4CsgxAAAAgKOwk2O+/vrrI0eOkM2KigpaHZPjBHja+eQcZ2sDAAAA2xI7vytTKBSlpaX//vsvOu6tpaWlqqqKekNRUdHExERfX9/c3FxOTs7u3bvff/99jHI+uVqtRqfdkWdrm0ym9PR0RxkEAAAAbB3s/gVNQkLCjz/+SPz3J1TU8zC4T4Cnnk/OdrY2AAAAsI2x/32MQqFobW3FMKy1tVUmk7m5uZGXuE+Ap1bDOM7WBgAAALYr9nNMenp6W1sbhmGtra1Q4wIAAAD4Yz/H7N27VywW//LLL93d3bR/viIWi11dXR88eICaOp2O/EdDNMRisZOT09jYGHnnurQGAAAAXgR4/XY5PT29pKQkMTERffO/uLiI+p2dnTMzM4uLix8+fNjf369UKrOyshglODs7y+Xy4uLisbExdOcG6Q8AAABsXfjmGI1Gk5GRgWHY2NiYSCQiL127di0oKOjAgQOpqalpaWkFBQVsQurr661W6759++RyOVsqAgAAALYTvM6SmZ+fF4lERqNxo/6oZXBw8ODBg//888+GSAMAAAC2Jrz2MXfu3ElMTNzAv5qEs7UBAAB2AvbP9p+dna2vr8/MzFznk+BsbQAAgJ2G/X0M+V9I1/kkOFsbAABgpwFn+wMAAACOAs5dBgAAABwF5BgAAADAUUCOAQAAABwF5BgAAADAUUCOAQAAABwF5BgAAADAUUCOAQAAABwF5BgAAADAUUCOAQAAABwF5BgAAADAUUCOAQAAABwF5BgAAADAUUCOAQAAABwF5BgAAADAUUCOAQAAABzF/wBjzC6z+j6I5AAAAABJRU5ErkJggg==)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	9 May, 2020 16:06 GMT
Vulnerability Verified:	9 May, 2020 16:15 GMT
Website Operator Notified:	9 May, 2020 16:15 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	9 May, 2020 16:15 GMT

JSON