juneihan.com Cross Site Scripting vulnerability

2020-05-1207:51:00

g0bl1nsec

www.openbugbounty.org

JSON

Open Bug Bounty ID: OBB-1159419

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	juneihan.com
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	g0bl1nsec
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAANKUlEQVR4nO3df0wb5R8H8BsU6Og1QmkLozB+qIwsBolBMxWN2cj8kUUxZhtT1C4muC0baRpEmUYrGmY2wLnoNAaTGU30j2VZiDEzIWoqaeaGza3rfpXObDB+zADCvG0tFPv94+Llvverz649trH3668+17vn+Xw+98DTu9KyJB6PUwAAADpIu9kBAADAooU1BgAA9II1BgAA9II1BgAA9II1BgAA9II1BgAA9HJLrDFlZWUnTpxQagIHZdEGdVvETpw4sXXrVpUd5ubmNm3adPnyZcIOMVtS7uavMSdPnvz333/vv/9+2SZwUBZtULfFzel0lpaWquyQkZGRmZnZ0tJC0htmix4SrDEXL140m82yT83MzOzatUupSa63t/fZZ5+VNlWG1obvMOU9LwBRlYRuKB1tuf/999+bN2+22WwOh+PNN9+cm5u70R60Sf5MqdQttTEknP/C6Zebm5tMSBqQZKH5R3ghCYOcnJwMBAIul4t/NhqNbtq0SZSpy+Xq6+sj6Tz52QJS2q9jpqenOzo6lJrklNaYkpKSiYkJzeFJpbzDhaQy+xcgL6fTOTs7yzDMzz//7PP53n33XV2HS6Hkf2sQllfz/F8YJFnc4ilwhEGyLJudnZ2VlcU1o9HoU089FYvFRIdYLBaWZUk6xxqjh5t8r2xsbCwUCj3xxBOyTX72pErKO1wYorJI6ZrX9evX/X7/l19+6XA4VqxY0d3dffDgQf2GEzIYDBUVFZoPT1g3QikpL59LkklpdptOfnLj4+N1dXWdnZ3aDk/VbAERojXmk08+KSsry8vLe/nll2dmZiiKmpmZKS0tZVl2yZIlX3/9tbDZ3d1tNpv37NmTn5+fm5v76quvXr9+Xann3t7etWvXZmRkSJvc1b3oGl94n4F7qqurq6ysLDc396WXXuJioygqGo2+9tprZrO5pKTkvffem5+fpyS3C6RJcY4fP/7www8vXbrUZrOtX79+ZGREZSCh+fn5tra2/Px8k8m0fv36yclJbvvVq1dff/11m81WXFz8/vvvz8/PCzs0mUwbN26cnJx84403bDZbXl7e5s2br169qlQl6Siyt0G4jUpnQTZ3pUOWLl06PDxsMpm43cLhcGFhIVeoxx57zGw2OxyOF1544cyZMxRFLfl/otNEkqyQw+H4448/+OZPP/2ktKfsDsK6yUarVMxdu3bZbLZly5Z99dVXwvIqlUj04yAbKp+Lw+H4/fffCTMS7kOYAh+nbBbJpKB0rHQ4Sm7aU8STgTxIoZKSkrfffjthPaWF5WiYLeRj3ckSrzEsyzIM4/P5jh07Njo6+tZbb1EUddddd509e5am6Ugk0tjYKGw+//zzLMseO3ZsYGBgYGDA7/fv3r1bqXOlG2WEWJYNBAJcbENDQzt37uS2t7e3X7t2LRAIHDlyxOv1fvHFFyRJcfx+f1NT0/j4eDAYLCoq2r59u8pAQrt37+7r6+vr6wuFQoWFhadPn+a2Nzc3j46O+v3+I0eO9Pb27t+/nw+gv7+fYZjR0dHKysqJiYlAIHD06NELFy6I+heWRWkU2eLIngWV3BOeuHPnzrW0tHAvFdetW+d0OoeGhvr7+2tra41GI0VRkf+0trY2NDQIR0yYrE1CNLrT6VyzZo1w1eEdP358zZo1TqdTqW6y0coWk2XZs2fPBoPBAwcO1NbWklRV9OOgHiphRtKkyFNQzyKZFFQmlWg42WlPEU8GwiC1SeFsgcTiqi5cuEBR1JUrV7imz+crLy/nn6JpWrgn1+QOGRoa4rYfOnSopqaGezw0NFRaWsofwrIsTdNTU1OyTa5D6Sg5OTmysfX39/OxWa1WlmW5xwzDPPTQQ9IIZZMSCYfDBQUFKgMJ2e12v98v2hiLxWia/vPPP7lmb2/vqlWruA6np6f5DtPS0q5du8bHc8899yhVSTqKqETC4kjPgvoJVTpxnEuXLpWXl3///ffxeHxqaspgMEQiEdm6BYPB5cuXT0xM8N2SJHtJQtQty7IdHR0Wi2XDhg2hUIjbGAqFNmzYYLFYOjo6+JMuqptStLLFpCiKr7aovColEp0F2VCllHaTJkWegnoWyaSgPqmEw8lO+zjxZCAMUmnmizYKt6R2tgCJxGuMyq94pTXGaDTy20+fPm2327nHsVhsdHSUf+rQoUOrV69WapKsMbJPTU1NURRl/Y/FYuECEEao1Gc8Hvf7/XV1dYWFhdyxOTk56vtzpqenDQZDLBYTbR8dHc3MzOSboVCIW7RUOhQ1hWWRHUXpJ032LKjXU+nEcVatWrVv3z6+2dDQUF1d7Xa7Ozs7f/31V+GejzzyyOHDh2XDU0+WxNTUVH19vcFg4JoGg6G+vp7/tcUTTSdptITFFP1SUyqR7FkQhUqYkVJShCmoZ5FMCoSTKq4w7aV7Kk0GwiA1rDGpnS1AYkHf809PT1+2bBnfTPJGmZJIJJKWljYwMMAwDMMwgUCAYRjyw+vr6x9//HGv18swzI8//nhDQ6enp99gsIlJy6LHKAmNjY0FAoEdO3bwW7777ruenp6qqqrZ2Vm3280/9dlnn5WXlz/33HM3OkTCe2UURZ0/f3779u1er7e9vZ3b0t7e7vV6t23bdv78eeGeoropRatfMaWhku8mm9Qtm8Jt5JadLYuZ+hKk7TqGElznHj58WHTLhROLxaxWK381LWryHV65ciUtLU14nyrhdUw8HqdpWvYGQsLrmL/++kv4cpJhGMLrmHg8brfbGYaRpil7r4zwpb20LNJRSO6V8Wch4b1HpRMXi8WEYYgwDFNUVBSPxy9dulRZWal0r0k92YT3yrZs2ULTtNvt5u7C8SYmJlwuF03TW7Zs4aMV1U02WpJiqtwrE5ZIdKBSqIQZySZFmIJ6FsmkQDip4qr3ygivY0iC1HAdE0/pbAES2q9jrFZrJBIZHByUbbrd7pGRkVOnTnk8nnXr1vFHRaNR7oHP5ysoKCgrK5Nt8sxmc01Njdvtvnz58uDgoPANahWNjY3btm07derU2NjYnj17PvjgA8KkbDabxWL5/PPPZ2ZmBgcHPR5PwkP4jFwuV1NT08mTJ0dGRnbs2PHbb79RFJWent7Q0OByuYaHh7lqvPjii4TBUHJlkR1FNh5K+SyoUDokPT2d+3MyzpkzZ55++ulffvllcnJyeHj4008/ra6upiiqubn5ww8/zM7OjkajwkhIOCREO7AsGwwGu7q68vLyhNvz8vI+/vjjYDDIfwxCVDelaBMWk7xEovmvFCphRtKkbp0USCZVktOeMMi0tDTpp2GkYrGYwWDgmws8W0D7dUw8Hvd4PNnZ2QcOHBA2u7q6aJr+6KOP7HZ7Tk7OK6+8wr+nJ+ytpaVl586dfFeipnDncDi8evVqmqZXrly5b98+kuuYSCTicrmKioqys7OfeeYZ7hUK4fsxXq+3pqbGaDQWFBS43W716xjhU7FYrLW11Wq1Go3G+vp6/tUfy7JNTU1Wq7WoqMjj8cRiMfKX9tKySEeRfWXHPZCehYS5yJ44aZCzs7Mej6eioiIzM9Nutzc2No6Pj8cl/7c7YbU1vB9DQlQ3pWjViyksi/CxUolEPw6pRZ5CXPW1fDIpEE4qjnTaS/dUuY4hCTISiRiNRtGfVEiDOXjwYFVVlUptNc8WlT6Bl2CN0UB2wklVVFQcPXpUqUnez+ImLQshDdVbTAXXXDd1i6BEyaSwYOmTD9Tc3Cx8r14qEomUlpb29PSo7KPTbAGOQfbiZgGcO3dOpQkclEUb1O0O0dnZqf4XPVlZWd9+++2jjz6qsg9mi65u/vcuy5qbm/P5fEVFRTc7EAC4dWVkZDz44IPq+6gvMKC3m3Ydo66pqam3t7enp+dmBwIAANotiUvep1V38eLF++67759//lHZZ2ZmZv/+/W1tbcnFBgAAt7cbXmMoiopGo+rf4UqyDgEAwKKn5f2YRf8l4QAAkBJE/wcz5V8SDgAAdwKi7/bX40vCAQBg0SO6V7Z37978/Pwnn3xyxYoVoqe6u7uLi4vvvvvu9vb2H374gdvI/buFrKws7ivkwuFwXV3d2rVrN27cyH9TBQAALHqJ1xiapvl/PSliNBqLi4u5x5WVlUNDQ7K7mUymtra2cDg8Ozu7cuVKzbECAMDtZYE+g7n4viQcAAASSmqNiUQiw8PD3ONQKLR8+XLZ3bZu3VpdXV1QUBAKhfChGQCAO0eyn/N3u9179+6dnp72eDz19fXcRv77t++9917qvy8JLykpSTZYAAC4rSR1HUPTdE1NzQMPPFBbW1tVVdXa2sptN5lM77zzTnV1Nfe3y9988w0WGACAO5CWz/lz8GF+AABQd4t+7zIAACwCWGMAAEAvWGMAAEAv2t+PAQAAUIfrGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0AvWGAAA0Mv/AB0kyvu25h/0AAAAAElFTkSuQmCC)

Screenshot: juneihan.com vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	12 May, 2020 07:51 GMT
Vulnerability Verified:	12 May, 2020 08:01 GMT
Website Operator Notified:	12 May, 2020 08:01 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	12 May, 2020 08:01 GMT

JSON