Lucene search

K
openbugbountyG0bl1nsecOBB:1167850
HistoryMay 21, 2020 - 7:32 p.m.

staydo.it Cross Site Scripting vulnerability

2020-05-2119:32:00
g0bl1nsec
www.openbugbounty.org
7

Open Bug Bounty ID: OBB-1167850

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: staydo.it
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: g0bl1nsec
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAANJElEQVR4nO2df2gb5R/Hb1vWHt0Nu5BmWdfNOLUTCbWMWgKGUWqpMkYJpdRNQo1jSCdaQihzKzJC/8hGjaVIGUOqTBzqH2WUMWSOIRJkSKglq6HULAttDFmVGlMNLuuC5x8P3Pe+9+PJNcnVtHu//rrn7nmee38+zyf3uXvuR7bwPM8AAAAAOrD1vxYAAABg04IcAwAAQC+QYwAAAOgFcgwAAAC9QI4BAACgF8gxAAAA9KJyc8xTTz11584dteKGYCNqrhzgvU3MnTt3Tp06Ranw6NGj48eP//rrrxo7RLRULBWaY3766ad//vnnhRdeUCxuCDai5soB3tvcuN1uq9VKqbB9+/aqqqrBwUEtvSFaKpkCOWZxcXHnzp2Km1ZWVs6fP69WLJFr1651dXWpFQuKKY7FxcVdu3ZprCl2i+Le1TRTXKorf/zxx5tvvllXV7d379733nvv0aNHajXFCotzbOk2FhzxcmkoaKDQj/bwKCNarCjvT08nxCJ///332dlZj8cjbH348OHx48cllno8nlu3bmnpvPRoATrCU1lYWOA4TssmSs0iaG1tvXnzplpxTTq1s7CwUFtbq7FyLpej752iWdx23ejq6nr99deTyeT8/LzD4Thz5gylsqCwOMeWPhwFR1wLWvxcUKpQYU3hUUYKWlHen55OiEVKBOdyuba2tp6eHokV2u0qS7QAnajEubL79+9Ho9G2tjbFYoVQXV1N2UrXTG+rBw8ePJiZmfn444/37t178ODB0dHRyclJSv0SFRoMhsbGxqKbl2vEy+JnwZYSjSqa9Y+WdWZpaamjoyMQCBTXvDKPD+B/0FMQOZUYGxuzWq1Go9HlcmUyGZ7nM5mM0MPly5fFxQ8//JDjuJGREbPZXFtb29fX9/fff5PeQqGQw+HgOK6+vr67u3tubk5xp5cuXert7VUsKvYgERMKhex2O8uyJpOpp6cnmUzyPD8+Pt7Z2Sn0OTQ01NfXx/N8Mpns7OzkOK6xsdHv9wsnqtls9q233jKZTA0NDT6fL5/Py91CliV7l2gmNf1+v8lkslgsExMT4rb5fP7MmTNms7mmpqanp2d5eZmsz+VyJ06c4Dhu//79586dy+fz8n4ozRU9IOaLL744fPiwmgZBocQ0NR8W5MaNG2uqUHDE1TSr+Zksy2NSPnYFpWq0SFxHowk8NVpKMUGtrWJQKUY+qRkIBKxWa01NTW9v7/Ly8uDgoMlkMhqNbrc7m81qF6l4gSJfqXYdU3q0FBw7UEYK5xiGYdxudyqVisVi7e3t/f39ZNP8/DzHcblcjkShUIzH4wzD9PT0JBKJWCxms9l8Ph9pYjabJyYm0ul0PB4fHR2Nx+OKOz1y5MiVK1cUi2o9iMVcunTp008/zWQyS0tLHo/H6XTyPJ9MJlmW/fPPP0l9m802NTXF87zT6RRLFXLMiRMnjh49mkgkIpHIoUOHPvroI4lbxNEvcYVYM3FgX1/f0tLSjRs35ufnxW39fn9LS8vs7GwymRwYGAgGg2T90NDQsWPH4vH43NxcW1vb+Pi4vB9Kc0UPiNXW19eHQiE1DWKFYtPUfGiSIRlQi8XS3t4+PT0tH+tQKNTe3m6xWNQCQHHEFTVT/Ey2KsakZOwoUjVaJDdKowk8NVpKMUGtrWJQKUY+qelyuZLJZDQadTgcJpOJHBbINcTAwIB2kUXnmHJFC31wQXnRlGOEw8rt27cPHDggbFK8H0OaJBIJsv7q1astLS08z6fTaYPBoDi5nEgkrFYrWc5msxzHpdNpeZHSg9opTywWEyLSbrdPTk4KlUm4sywrlkpyTD6f5zhOSGDXrl2z2+2U3UmKYs3EG4I5kspms3lmZkYu22QykRNDnufD4XBra6u8H0pzNQ/wPJ9MJg8cOPDVV19ROqFMnct9SPqUINGQzWb9fr/RaOzt7Y1Go2RlNBrt7e01Go1+v18wltc24oqaKX5Wi0m5gYpS5ahVkxul3QS6FaWYoNZWvju1yCc1yRwGz/Pff//91q1bhfmJ27dvP/PMM9pFFpFjyhstYD1Z2z1/8W1PSo5hWVZYPzc3ZzabyfKxY8eam5u9Xm8gEPjuu++EOvl8PpVKkeWrV6+2t7cLmyRFtR7EYmZmZjo6Ourr68mFvCD4woULbreb5/nx8XFycZ1KpSRSSeVUKlVVVSWsj0ajklMneo4Ra6b8cjKZjMFgkMzC8TyfTqcZhhGuCYxGo9lslvej1pziAZ7n7Xa7+JpMsRPK4UDuQ+2k02mn02kwGEjRYDA4nU7hsCVQcMQLala0Qi0mFY93EqkaLVIzSqMJdCtKMUGtrbyhWuRTjgPiokaRReSY8kYLWE/W9Z7/l19+OTEx0dTUtLq66vV63333XbJ+27Zte/bsIcv0p5bVehDjdDoPHz4cDAbD4fDXX38trO/u7ibF69evd3d362GgomY627Ztk6zJ5XJbt26dnp4Oh8PhcHh2djYcDmtvzqh74P79+7Ozs3KnKXaiiKIP62TIG967d++dd94JBoPDw8NkzfDwcDAYfPvtt+/duyeuqXHEtWteK3Kp2qspGlWxJmwgKjZaQGHoKai46xhGdL08NTUlXC+LCYfDDQ0NkpX5fN5kMgmX6pIipQdh77/99pv4vDIcDotPuGw2261bt2pra8nsn2SubGpqqvS5Molm+tmZ2WwOh8Ny0ziOo8xfCSg2p3ggn8/LnSnvhH7KKfEhr2GurL+/n+M4r9crud26vLzs8Xg4jhNu8mkccbpmRSvUYlLSUE2qRosUjdJoAt2KUkxQayvfHWWuTON1jBaRxd2PKWO0gPWk+ByTzWYNBoMwGS0Uhft+yWQyEok0NzeT+35zc3Ovvvrqt99+u7y8nEgkTp48efToUaFnMosaDAZtNpuwUlKk9CAWYzabL168mMlkotGo0+kU/xjOnTvX1NQk3i+55y9IFSqfPHmyq6tLcudT7a0R8d4lmum/HL/f39raSu5GkhNPsr6/v99ut0cikVQqNTIyMjw8rPizVGtO8YB8tlreiXhfklFW9GFBXC7XwsKC2taFhQWXy0WWNY44XbPQrfyevyQm5QbSpWq0SGyUdhN4DTmmOBPU2ioGlWLkrynHFBSZSCTEU2oSSwVisZj8haSyRAsP1pHicwzP8z6fr6amRnhglxTJs8sXLlyQPL+4urrq8/kaGxurqqrMZrPL5VpaWpLsZXBwcGhoSOhfUqT0IBYTDAZbWlpYlrVYLF6vVyyYTDoJgvn/f3Y5EAhQnl2mn4gJe5doph/78vn86dOnTSYTy7JOp1P87LLH42loaKipqTly5Eg8Hlc8HKg1V/PAgtJbhPJOJPuSjLLch2VE44gX1MwrnTjLY1LRwPKi3QS+UI4p2gS1topBRXl2WdyhWo7RIjKXy7EsK3mkQi5mcnKyqamJ4tuio4XSJyg7BXJMESgGrkYaGxt/+OEHtWLpZLNZlmUlT2eVl7JrrjR09aFO3islJiuEUkxYN/O172hgYEB8r15OLpezWq3klR01Nv1vbXNgWM97PwX5+eefKcXSuXnzpsPh0PWrU2XXXGno6sNN7z1ACAQClCdZGIaprq6+cuXKSy+9RKmDaNkQVOK3ZHRiZWWFPHH7XwvZwMCHoCxs3779xRdfpNehJxiwUXiMcowwR/xfC9nAwIcAgDWxhef5NTVYXFy02Wx//fUXpc7KysrFixfPnj1bmjYAAAAbmzXnGIZhHj58SP8WrJY8BAAAYNNTzFzZpv/YOAAAgLKg6X8wz58/X1dXt2fPnk8++UT8t4A7d+784IMPdu/evWvXrjfeeOPBgwcMw6ysrFit1mw2u2XLls8++4xhmG+++WYdLAEAAFBpFL6OyWaz8/PzkUjk8uXLDodDsikUCk1PT09PT8/MzIyMjDAM88QTTwjf8Xa5XAzDuN3ul19++ccff9TJBgAAAJWJprmysbGx3bt3v/LKKwcPHpRsGh0d3bdv39NPPz08PHz9+nWykmVZhmGqq6vJp+hisVhHR0dnZ+drr7129+7dsuoHAABQuRTOMRzHqb1wx7Lsvn37yPJzzz2XSCQUq+3YsePs2bOxWGx1dfX5558vWisAAICNxTq9H7P5PjYOAACgICXlmFwu98svv5DlaDS6f/9+xWqnTp1qbm62WCzRaBQvzQAAwONDqd8r83q9Y2NjmUzG5/M5nU6y0mQy5XK5u3fvPvvsswzDZLPZSCTy5JNPlioWAADAhqKk6xiO41paWg4dOuRwOJqamk6fPk3W79ix4/33329ubibPLn/++edIMAAA8BhSzHv+BLzMDwAAgM5j9E1MAAAA6wxyDAAAAL1AjgEAAKAXxd+PAQAAAOjgOgYAAIBeIMcAAADQC+QYAAAAeoEcAwAAQC+QYwAAAOgFcgwAAAC9QI4BAACgF8gxAAAA9AI5BgAAgF4gxwAAANAL5BgAAAB6gRwDAABAL5BjAAAA6AVyDAAAAL1AjgEAAKAX/wLAF9G2ni/TcQAAAABJRU5ErkJggg==)

Screenshot: staydo.it  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 21 May, 2020 19:32 GMT
Vulnerability Verified: 21 May, 2020 19:46 GMT
Website Operator Notified: 21 May, 2020 19:46 GMT
a. Using the ISO 29147 guidelines
β€” β€”
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 21 May, 2020 19:46 GMT