Lucene search

K
openbugbountyHacker22385OBB:1164618
HistoryMay 18, 2020 - 8:30 a.m.

torezista.com Open Redirect vulnerability

2020-05-1808:30:00
hacker22385
www.openbugbounty.org
6

Open Bug Bounty ID: OBB-1164618

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: torezista.com
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: Open Redirect / CWE-601
CVSSv3 Score: 3.4 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: hacker22385
Remediation Guide: OWASP Open Redirect Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAARI0lEQVR4nO2dfUxbVRvA71jFWu/4snR8dFshc1vmwhjBioQsZFkmYoMVyYJItukQzUKIEoIEDeI0bCJbzHRIFkzYYqZ/kEkIWciCixKCC0FSWUOgWbDU5lJZwwA7Vmrhvn/c1/Pe9557Tm8LBTaf31895577nOc5H/e559zb527ieZ4BAAAAgDAQsd4KAAAAAI8s4GMAAACAcAE+BgAAAAgX4GMAAACAcAE+BgAAAAgX4GMAAACAcLEhfExKSspvv/1GSgJrD3QBAACrwvr7mNu3by8vL+/fv182Caw90AUAAKwWAXzM5OTkli1bZA/Nzc2dOXOGlFROV1dXQUEBKbkGhKy5QihtuGY6BMUKu2BycjI2NpZRZrhCgm2fEKq+d+/eG2+8ER8fn5yc/P777//999/08u+9994TTzxx+fLlYBVA7UNifHz8xRdfjI6O3rp168mTJ+fm5tChxcXF1157DZf8888/Hzhw4Mknn3z++edv375N11yJngEbMIQWxjtR1pyQbQlWQ3oBsbYbano+fPBU7HY7y7JKDlFK0jEajTdu3CAl14CQNVeO1+tddx2Us8IusNvtMTExwu+AhiuXGVT7hNCeBQUFJSUlTqdzbGwsJyentraWUtjtdkdERFgsFr/fTypDsl3cPrKkpqaWlZVxHOd0OktKSoqLi5HA3NzcoqIi3LSEhITOzs6ZmZmGhobMzEyKcFwZUkPR+y6EFpacQjInZFuC1ZBeQHx0Q03Ph4513iubmpqy2Wy5ubmyyUeGxx9/fL1VUMrqdsHDYviDBw+Gh4cvXbqUnJy8e/fu8+fPd3R0UMp7PB6NRrN///7NmzeTyoRm++LiYmVl5fnz5xMTE5OTk2tra/v7+4VDLpfr8OHDzc3N+Fl+vz8zMzM2NjYzM9Pn84VQL064+45kTjhsAdYTugsSHPgXX3xhMBji4uJKS0tnZ2d5np+dnUUS2tvbxclz586xLNvU1KTT6WJiYo4dO7awsECS39raevToUTxpNpubmpqETIvFEhkZKdTL83x5efnOnTspR6urq+mnV1dXoxolhvA87/F4ysvLtVqtXq9vaGgQblSFdmhsbNRqtQkJCW1tbTzPe73eN998k2XZ7du319fXo1taSQtLboIGBwdzcnJYlk1KSiosLBwdHcV1GBwczMrKUqvVWq22qKjI6XTiTef3+2tra3U6nUajKSoqcrvddOWbm5sNBoNGozl69Kjb7a6urtZqtXFxcSdOnPB4PHgXBGWy0+k8cuQIy7K7du1qbGwU7tOR4UGJwu3C20cyPvHBRhq3pPISrl69evDgQVJHuN1ukj4SxVBStn0C4vP5ampqjh07RpEsUF9fn5aWdurUqbS0NKvVivIDTgR6QyE5eKeQTiRB6kTcHJIteGHxihAfYwrXMbImiLX9+uuvxZpThhA+tSm1/3sIvI7xeDwWi2VgYGBwcJDjuNraWoZhoqOjx8bGWJb1er2lpaXi5CuvvOLxeAYHB4eGhoaGhoaHh5uamkjCSQ9jTCZTb2+vkNnd3b28vNzT0yMke3t7zWYz5Wh+fj799Pz8fFSjxBCGYSorKzmOGx4e7unp6erqamlpQe0wNjZmtVrb29tzcnIYhjl9+vTCwsLIyEhPT09fX19ra6tQ0vsPNTU1xcXFEpNNJtOJEyccDkd/f39OTo5arcZ1GB4eLi8vd7lcVqtVr9dXVFTgTdfU1NTb29vb22uz2ZKSkkZHR+nKWyyW/v5+i8XCcdyePXvcbvfIyMitW7fsdntdXZ1sjyg3uaKiIioqanR09Pr161evXsW1VS4KtwtvH4lk2cEmO24p5RHj4+PV1dXC/bVsRzz11FMUfWQhtU88Bjr0ww8/aDSawcHBS5cuBZTPsuzExER7e3tPT88zzzyD8pVMBFJDiZEdbJQTcbvonajEloDgY0yMbFOTTBBr+9Zbb0k0Jw0hfGorV/5Rhu6C7HY7wzDz8/NCcmBgIDU1FR2SfR4jnOJwOIT8a9euoU1Vh8NhMBjQKR6Ph2XZmZkZPMlxnEajEXaEjUZjVVVVSUmJIDwqKsrhcFCO+nw++uk+n09iIzLE7/cLQ1xIdnV1ZWVlIaOQqgJarRatACwWi9FoFB+1Wq3bt29Hd3xC5szMjEqlwne6Kfdcd+7cSUhIwPN1Ot3w8LA4h648ukfr7++PiIhAN18DAwM7d+4Ufou7QLnJfr9frVaLexxfxyhvPdwuSvuQBhtp3FIGp4DT6UxNTf3+++/xusQdEdReP6l9hOokIAkLCwt9fX379u1rbW2lN0VbW1taWprL5crNzc3LyxNU1el0fKB55PP5KA0lrgXvFMqVgWSXbKNJMim24IUl6xjJGMOXkhLoJpCex5CGEGlqA8E988cXp3hJu92uVqtR/ujoKBoifr+f4zh06Nq1a4cOHSIl09PTb9686XK59Hr97OysTqfz+/1tbW2FhYUBjyopIGsjx3GRkZHokM1mEy4r+PSYmZlhGEb7D3FxcchMgezs7M7OTvzc4uLi9PT0qqqq5ubmn376SbYxh4eHDx8+nJSUJEjGt1ZmZ2dVKpXkgbNC5SXPnMVJcRcoN5njOEmPy+6VKREla5esBJQvO9hIJlMGp0BWVtaFCxdQktQRQfkYUvso4fr16xkZGSTJAsgBcByn1WobGxtv3bqVnp4uHKVPBEpDoXzZTqEPKlmU+Bi6LcovR6TqlJtA8TGkISQ7tQHVGiyVEJs3b05MTERJ+lvL+fn5vb29ExMTJpMpOjo6PT29r68PLfDpR5UUWCFerzciImJoaEil+m8bRkT8b+Px4sWLqampL7/8Mn7id9999+uvv1qtVo7jqqqqsrOzv/zyS0kZs9lcVlbW2tqqVqudTmdeXp6sDpQHzqFBf2uZbnJQ0EWtul0KmZqaGhkZ+eWXX1COwo4IGfHmmADHcRaL5dlnnxWSqampHMdRJNy9e3dmZubAgQMMwyQmJra3t5vN5qGhIbRZtFoTIahOwe26e/duwLMC2rIScJWGhoZWLlaMkqn9b4TugkJbxzCitWRnZ6fsC4h+v1+r1aKNHUmS5/mBgQGj0VhQUHD9+nWe51taWiorKxMSEoSVEP2okgKyNlK2m/B7IpZl8V0dnuedTueePXvQsp1yP2WxWPR6vaTM9PS0SqUSl5G9Q9TpdBaLRZyjUHnSOkbSBcpNluwFdXZ2BlzHkETJ2kWSwJMHG+X2nDI4/X6/eARSOmIle2WofXi5DRyv16tSqdDg6erqkuzB4k/j1Wq1zWZDOeXl5QzDoKfl9ImgZB3Dy3UKfVCFtlcW0Jb5+fmIiAi0u9Xf3698HSO7VxbaOkbJ9Q1NbSB0H+PxeFQqFRoQKCn0gfASjtVqTU9Pb2hoQBLQfqWw14zyJUkBnU6n0+mEU5xOZ1RUFFo1BzwasADSRGJIWVlZQUGBw+GwWq0ZGRnCzons9HjnnXeysrKE25ampqbTp08L+YWFhR0dHejJv/jc0dHRvLy8mzdvut1uh8NRVlZmMplwHXQ6XUtLy+zsrM1mM5vNsn83aWxsNBqNIyMjTqezoqKir69PofIkHyPpgqBMNpvN4h5X4mNIomTtkrQPagfSYKP7GNLg5LE/hZA6Ith9GNn2IWEymYqLi51Op8Vi2bt3b0tLC0Uyz/OnTp3Kzs62Wq1ut7u9vV14serDDz8UW0GaCAp9DN4pIeyVSTpRVoGAthiNxrKyMpfLZbPZcnJyKD0yPz+vUqnGxsZI/2GimyDWVvybNIRIUxsI3cfwPN/Q0KDRaNCbiEJSeHf57Nmz+Lt9YmnV1dV1dXVIlCQpUFJSUlRUhJKZmZniMvSj9AISu8SGUF7/lajn9XrfffddvV6v0Wjy8/PRLbBkpSg+1+fzNTQ07Nq1KzIyUqfTlZaWulwuXIe+vr7MzEy1Wp2QkFBVVSU77f1+f01NjVarVavVZrM54LvL6ESSj5F0QVAmi9/NbW5uVuJjSKJk7RK3D36DiQ82+qVTdnDiLUPqCJJFYvCbaLx9SExPTxcXF8fExOj1+k8//ZQuWWjJ2tpag8GgVqszMjK+/fbbiYkJjUYjuGc+mIlA8jF4p4TgY3jsioFXFNCWO3fuHDp0iGXZvXv3Xrhwgd4jtbW1kurEBDRBrK1k+OFDiDK1/+Vs4rFr4gqZnJzct2/fX3/9RS+2e/fuK1euPPfcc7JJYO15GLtA4WALuTwASIAhFCxr+sxfzPj4OCUJrD3QBQAArDohvhcE0fgBgJH7Z58A3OcCgEAo6xiIxg8AAhaLRTZ/tQJOA8DDTijrGPr/Wnbs2BGOm7jVChS/igHnSUAk8DUj2MG26oMzmcAqVgFsKMJ0fXuEWX0fA8zOzjY2Nq63FgAAAOtP0D7mXxKNHwAAAFg5QfuYrq6uI0eOPPbYY3jy/v37b7/9dnx8/LZt2z7++OOlpSXmn72pzz//fOvWrbGxscePH3/w4IFw7uLi4smTJ7ds2bJjx46PPvpoaWlJKHzu3LmUlJTY2NjXX39d/BFAhmE+++wziRzJ3pf4I4NTU1MvvfTSli1bUlJSzp07J/74IC6Hrj8un6Tq3NycwWDweDybNm26fPnyxYsXX3jhBXT6Bx98cPz4cUmT4vUKws+cORMfH5+YmPjNN9/QzQEAANiYhOJjSBtllMDysqGwZaO7ezyekZERIdq2w+EQh533eDxD/0D/ZIBARUVFZGTknTt3ent7r1y5ElAOSX8SsqpKYpibzea+vj60gdvV1VVYWCiRI1svHqicZA4AAMDGJeC/NMUB+SnR+OmB5WWjqePR3e3/H227v79f/CkBWTmkP+sKsY+QPuKA87Jygg32RVdVfEpWVlZHRwfKl0Qrka3XjgUqJ5kDAACwkQn87nJSUtLAwIDw+8aNG0ajEe3SiJPT09M+ny8lJUU4tGfPHuFCyTCMWq3etm0bync4HAzD3Lt3z+12GwwGIX95eVkIwcuyLNqb0uv1QhB4ihwS09PTy8vLYn3ocij6k6CoKsZsNnd3d7/66qvd3d35+fmST9iS6mVZVrwbRjEHAABgwxLYx4gD8q/iG2Wy0d0fyc93FxYWCptd3d3dJ06cWG91AAAA1o4gnscsLS11d3cjpyJJ6nS6yMjI33//XUiOjY2hNYrX6/3jjz+E3zabbfv27QzDJCYmajSamZkZ9JcC8adlZJGVExcXt7CwgB54OJ1OpE9ERMTk5CTShy6HpD9JvnKefvppnU73448/3rp1C/9oB6XdJMVI5gAAAGxclGyoCY8QAkbjJwWWZwjR1PHo7vTP1ZDkkMJ9FxUVmc1mu91utVrT0tICRneX1Z8kX/lXD3ier6+vT0tLE8f6Fj+VweuVDSIraw4AAMBGJrCPQde7gNH4KYHlZaOp49HdA34SrampCZdDCvftcrlMJhPLsgaD4ezZs2LfICtHVn+S/KC+eiBEHEFJybl4vbI+RtYcAACAjUwQsf1Di8a/QUJhj4+PHzx48M8//1yX2u/fv6/VajmOW60/tayvOQAAAAoJIibmQx2N32KxpKamrlftN27cyMnJWcV/Ta6vOQAAAApZt+/HrAGffPJJUlJSQUHBxMREXV1dfX39uqgxNzf31VdfFRcXr1DOBjEHAABAOSF+P+ahIDc3t6WlRa/Xl5aWVlZW4kFc1gb04GeFcjaIOQAAAMpZ/W8tAwAAAIDAo7yOAQAAANYX8DEAAABAuAAfAwAAAIQL8DEAAABAuAAfAwAAAIQL8DEAAABAuAAfAwAAAIQL8DEAAABAuAAfAwAAAIQL8DEAAABAuAAfAwAAAIQL8DEAAABAuAAfAwAAAIQL8DEAAABAuAAfAwAAAISL/wCr7s9efv0NGwAAAABJRU5ErkJggg==)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 18 May, 2020 08:30 GMT
Vulnerability Verified: 18 May, 2020 08:38 GMT
Website Operator Notified: 18 May, 2020 08:38 GMT
a. Using the ISO 29147 guidelines
β€” β€”
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 18 May, 2020 08:38 GMT