Lucene search

K
openbugbountyGh05tPTOBB:1173724
HistoryMay 27, 2020 - 11:56 a.m.

mail.cerciav.pt Cross Site Scripting vulnerability

2020-05-2711:56:00
Gh05tPT
www.openbugbounty.org
6

Open Bug Bounty ID: OBB-1173724

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: mail.cerciav.pt
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: Gh05tPT
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAXwUlEQVR4nO2dcUyTx//Ha+2w1oqIpSJUVtAw1jiHxhHcjCFoDGGEVIPIOqbozMYMQ2KYQ+KcQYaIuPh1CyHGLbiYxZiFEEKIM2wxHTNaGakdM7VhXce62mHFwjr2TJHn98dll/vd89z1aaEw4F5/9bnefe5z73v6fPrc8zyfZx7P8zIGg8FgMCKAfLodYDAYDMashcUYBoPBYEQKFmMYDAaDESlYjGEwGAxGpGAxhsFgMBiRgsUYBoPBYESK/0SMSU5OvnPnDmmTQWEmajUTfZ4umFaMmc70x5gff/xxfHz8xRdfFN1kUJiJWs1En6cLphVjFhAkxvz666+LFy8W/Wp4ePjkyZOkTem0t7fn5+eTNsMDuk3xPxJErjtReSeoVSS8RW2K2oc+P3r0aO/evXFxcYmJie+///6TJ0+meLIiB7r7LV26NGw7UKs///zz4MGDzz777MKFC5977rlTp049ffoUVrt48eLzzz+/cOHC559//pNPPkHdmIewcuXKI0eOPHnyBHMSqzl//vzk5OQTJ06ALuaJEfaIhF2HCkUKkg4yqhQSdZBFRoo5AU/F5XKp1WopX1Fq0snIyLh27RppM2w4jpuIVxPsd9IRHcgEtYqQOFABus/5+fkmk8ntdtvt9k2bNlVVVU39ZEUIOBCXyxUTExO2HahVQUGB0Wi02+2Dg4NdXV1ZWVkWiwXUOX/+vE6n6+jo8Pl8169fX716dU1NDeoGx3Ecx42OjtpstszMzKNHj2JOCmtardaMjAxgBxTa7faYmBjuX8IekbDrUCFJQdFBOEBUCok68JGRYi4wzTHG4/HExMQ8fvxYdHPizL7DFmTiWkVaHIrPo6OjOp0uEAiAcovFsnr16lkzWW63e/369eBDRkZGeEZQrRQKhd/vF62m0+nQ/xm9vb0qlQoIK9Szu7s7LS0NfBYeW7GaBoMBbk4wWGKEPdEUKSg6iPYIpQhJB36ypZgLSLoe87///S85OXnZsmVvvPHG8PCwTCYbHh7W6/WBQGDevHkXL15ENz/++OPFixefPn16+fLlS5cu3bNnz99//02y3N7evm3btmeeeQbbBCewZ86cSU5OXrRo0a5dux4+fPjee+/FxcUtW7Zs7969f/31F2hy+/btjRs3Lly4MC4ubufOnb///rtM2sn406dPjxw5snz58kWLFu3cufPhw4eg/J9//nnzzTcXL1787LPPfvjhh0+fPgXWTp48GRcXt2LFis8++4zUHO1X1LFdu3Z99NFH0IeNGzdevHgRboLmQukwtTGttm/ffvr0aVB4586dBQsWgDmSyWRvv/32e++9Jzoo2OmpU6ew7iYiPl156PPChQt/++23RYsWgfL+/v6EhASsMmVmgW9Lly59/fXX4WDv37//6quvLl68ODk5+cyZM2CRCvMHW7wS7ULUDl1DjMTExB9++AF8uHXrFij8+uuvSfUhaB2o1fj4uEwmUygUwvrDw8NutzsrKwuWrFu37vr16yT7SqWS47igboCaY2NjEl2dIEFNwQokKULVQSZZirB1EN215ibBY0wgELBarTdu3LBYLB6Pp6qqSiaTLVmyxG63g/PK4uJidHP79u2BQMBisfT09PT09PT29jY0NJCMUy7GgH67u7utVqvH40lLS/P5fDab7ebNmy6Xq7q6GlTr7e196623vF5vX1+fTqcrKyuTOPKGhoaurq6uri6Hw5GQkHD37l1QXlNTA86mr169ajabm5ubgTN2u72vr6+lpWXTpk2U5hBRxwoLC9va2kCF+/fvW61Wo9GIqS2UDlMb0yovL6+rqwsUdnR0jI+PX716FWx2dXXl5uaSBgW66/kXdKYiJL7oBaR79+5VVlY2NjZKERD4ZrPZwA45MDAAnSkrK4uKiurv7+/q6vriiy/onlC6INkhaRgnQLSvkpKSLVu2gNgj5Pbt21u2bCkpKRFqtWjRotzc3KKiou+//x5GdyiFUqmEf9EAL730EgzeKMPDw8ePHwf7A50HDx4cPXoU2zNDGk5IUExhspCkCEkHmWQpJqJD2MelWQj9NMflcslkspGREbB548aNlJQU+JXoWhloMjAwAMpbW1s3bNgAPg8MDOj1etgkEAio1eqhoSHhJjACT4q7u7vlcvno6Ch0Y/Xq1UJv+/v74+PjMWdIZ+Varba3t1dYrtFo4Ck2WJAFzkA/Kc1J3UHHRkdHo6OjgThNTU35+flYc5J0mGVUK4/Ho1KpwNJwRkbGoUOHTCYTaBIdHQ0W04SDonQ3EfEpKw/YdAPcbndKSsrly5cp6vH/f2bRHbK7uxvskGNjY0ql0ul0wrGABQ3hXkpa6ABdkOyQNARDwBC1HwgE6urqYmNjCwsLHQ4HLHc4HIWFhbGxsXV1ddA+ptXIyEhVVVVqaqpCoVi9evXx48fHxsboikGtNP8SFRVlMplEl4/QmrGxsUqlsrS0FL3YINSNNBwpCHcMoSlRWUhSBF18o0gRkg5CKaToAPfeuUlo12NQfSkxRqlUwvK7d+9qtVrweWxszOPxwK9aW1uzs7NFN+mHBnSzt7d369atCQkJYLfAjiyknc/v9ysUCvBDRRkaGkL3xdjYWK1WKzRCao7WFHWM5/mioqJz587xPL9169ZLly5hzUnSYT5g0qWnp3/77bder1en0/n9fq1WOzY2duHChR07dpAGReluIuJTYgzmMyAzMxOoIaxPn1nMGY/HExUVhY5FSowRdkGyQ9IwVIaGhoxGo0KhgCUKhcJoNGLXGES14nme47gbN27A69VutxudQQyXy6VSqUDYa2lpiY+Ph38UeMGxFdb0eDyiO7ZobMaGo0GAdYSFor9KzJSoLCQp6DrQpQhJB5IUwmkl/fznIFP6fMz8+fNXrFgBNyflrmWj0bh582az2Wy1Wjs7O0P1ByvhOE4ul/f09FitVqvVarPZrFar9OZSHAPLZY8ePbJYLGHfeYxplZub29XV1dHRkZeXt2TJkvT0dLPZDBfKQhpUSIQkvnB+79+/b7PZ3n333YkbDw/pXVA0lLhWJpPJfv7557KyMrPZXFNTAwtramrMZvOBAwd+/vlnWEj6LSxYsGDjxo3nzp27cuWKTCYDy6fwdmTADz/8ANeR5HJ5YmJiYmLinj17NBrNhQsXSL7BmitWrKDv2JThWBFgNdHCoKZEZSFJEVQHmWQpJkUH2ZTsvTMGeggK7zxGhqzAtLW1wQUflLGxMY1GAxclsE2Jf6UHBwfR/w5Wq1XieQzP81qt1mq1CsvVajW2CCZqRLQ5rElyjOd5juNiY2PPnj0LTjKw5iTpUB8wrXiev3HjRkZGRn5+fmdnJ8/zTU1N5eXl8fHx8KxROChKdxMRn3QeI/QZFKIlaP2gM4s5A9a4XC4XKIdrXCMjI3K5HF1bg2MR7YJkh6QhL3mtrLS0VK1WHzp0yOfzYV/5fL6Kigq1Wl1aWiqqFbpYxPO82WyGS9Y6na6rqwt+1dfXR7qv7PLlyzqdTvTOcilrTdg/ccpwQoVkCpMFQJKCogNPlSIkHXiBFKLOU37+c5DwY0wgEFAoFHAJEm6CI1dBQYHb7e7r60tPTz9+/Di0AHdxs9m8Zs0aWI5tSl+u0Wq1TU1Nfr/f4XAYjUbsSDQyMqJQKOx2OzjtRZdW6+rqMjIybDab2+0Gf0NAeWlpaWZmZl9fn8fjaWhoqKmpEd3zRJujNUUdA5hMpujo6CtXrmCyUKRD1ca0gt1ptVpgx+12R0dHp6enw2+Fg6J0NxHx0bao+KI+YzOCTRZ9ZoXOgCcnXC5XX1/f2rVrYXlGRsb+/fu9Xq/D4di0aRM6FtEuSHZENZROcXExDF2iuFyu4uJiXjC/drtdq9WeP3/e4/H4/X7wbV1dHfgWfS7EbDYbDIba2lpoENtvDQZDc3Oz8NswYkzQ4dBB551uCsrCU6Wg6MBTpZhgjCE5T/n5zzXCjzE8zx8/flylUrW0tKCbZ86cUavV9fX1Wq02JiZm9+7dokuflZWV1dXV0BS2Kf0wZzabN2zYoFQq4+PjDx06JDwSVVVVAScxm2NjY4cPH9ZoNEql0mg0wr8hHMdVVFTodDqVSpWbm+t0OkX3PNHmaE1RxwBtbW1qtVooC/ggKh2qNqYVwGQyFRQUwM0NGzagdYSDgt01NDRg3U1EfKwtFF/UZ+GRC9YnCUjxzev15uXlqdVqvV5fX18Py/v7+7Ozs9VqtcFgOHfuHNqjaBckO6IaRgKhVp2dnVlZWdHR0SqVau3atefPn0e/bWlpSUtLUyqVqamp8OIWL3bEvHTpkl6vB7eBTDDGTAQph3ISFClIOoj2CKWYYIwhQfn5zzWCxJgwkLgDpaam3rx5k7Q5NwlPuhnBFPsM/vD+d+yExEycXwaDhMiDXVPDvXv3KJsMCjNRqyn22Wq1pqSk/HfshMRMnF8Gg8RU3Fd2586dd955Zwo6YkycmTtZJ06c+Oyzzx48eHDr1q3q6urS0tLptTMtPHny5LXXXvvjjz+wz1Jg7xFgRIKpiDElJSV6vX4KOmJMnJk7WVlZWU1NTTqdrri4uLy8fM+ePdNrZ1p45plnoqKiKisrsc9BYe8RYEQK+lJaeFfn/H4/vO/F5/PJ5XJ4G8nIyEh5eXlSUhK4NFdfXw8fdEJbTZYnJCoqKpRKJbxbYXKB1x7T0tJIDxhOrnGJBL1ciU4WuOsMBeZo4DiuqKiIPhzROj6fr7i4WKPRJCQkVFVVYQk9c3Jy4F1PJLA6TqczPz8/JiZGq9Xu378fe2RPOIScnBzwld1uz8nJiY6O1mq1+/btE33WjzRMyvBHRkbi4+PtdrvwK5KrdE2CjlGoSW9vL3yqHP1Mp7a2tqysjKf+Qnny7odJrdPp0LFg19VhNblcrtfra2pqQBdhHKAY/30iEmMot2pQspQH7WuyMmmDI6nVahV9jneCkHKMT0qMoScwD0rQGCOcOJjDvLa2FmS+4TguKyuroKCAMhxSndzcXJjPH80zz/97dR29j06IsI7BYDh8+LDX63U6nUajESTRwYbDIcCjXkpKyv79+z0ej9vtNplMRUVFEodAH35tbW1lZaWo8yRXKZpIGaNQk1BvlALM1vcIMKadKY0x9Czlk3umItG9SYeUY3xSOqUnMA9KSDHG6/XCf/08zxsMhtbWVlCntraWPhzROoFAQC6Xo2nQUlNT4bcHDhwQHl4xsDrCJ910Oh1pOCgcx509exY+mGmz2bCGlGFShj8yMrJmzRpoFoXkKl0TKWMU6hZGjJnF7xFgTDuhxRiO4/bt26dWq5OSko4dOwaz0dXV1Wk0mvj4+AsXLvj9fnieiz2VAh4kFD0mirZCzWIPkTQ2Nur1+piYGJPJhP4kPB5Pbm4ueLihsbFRuLP6fD7YEXiUB+0FOPnWW29pNBqdToclHwSdqlSqwsJCn89XWVkJkhGVlJSAQYFRYMsdFosFxpizZ8/q9frY2Nji4mLUbYvFkpmZqVQqNRoNeCiSJKyocSiv0HO3271t2za1Wp2amlpXV4c+7YFNpXC60V40Gg3atcQnCbBnWUiPtvj9/tjYWK/XS7EmWsdgMHz66ac8z4+OjpaWlmKnIy6XS6VSlZeXgwdUKyoqhGeujx8/Pnz48O7du6UMgV5eV1dHWX0VdZX+KFLQMYpqIjHGXL16FX5ubm4uLCzkJfxCSbufsKOenh64uEp3qaenB42sQhFQVxkzjtBiTHV1dVFRkdPpvHv3blZW1qeffgpWV3fv3u31eq9evQpWomEiemFK1Pz8/Ly8vO7ubuF+jLXCzKIxBnzl8XjAk9sHDhyARnbs2GE0Gr1eb39/P/qQtmhHTqdT6Py+ffvy8vIGBgb6+vrWr18PFp1Bp8XFxW63G3Sq0WhKSkqAD1lZWeXl5Tw1RyGwAJqApwLRDBnNzc2ff/653+/3er0VFRXgOXPMt6CJ/0Q9NxqNBQUFAwMD/f39a9asgYIIp1I43ZADBw6AAaLDmcQY09jYSDrKQ0TrOJ3O6OhopVKpUCjS0tKwnQpoWF1dPTg4CIbf2NiIVmhtbVUoFFlZWaQ1GekxJhAIaDSalJSUhISE6upqYTATdVVKjKGMUVSToDHGYrFkZ2ej12lyc3NhelbSLzRo/k20I7/fn5eXB3+YFJcGBwdzcnIOHz5MESE+Pj47O7unp4fUO+O/TGgxRmLee8ouRcpSLmyFmcVijDC7O09O8E4alLCXsbExtVoNLbS3t2dmZsKaQdPdU468mNvoWxIwYJJ8kgKiiHoOBEGz99Mz1Yt2wXFcTEyMlBxuwiFLjDEpKSlWq5W+SCJap7y8fP369RaL5dq1azqdDpyJop6jDzO2tbVhb6UcHR0F+UhI9xpIjzGNjY0g3QMIZsLbMURdlRJjKGMU1YTy65uD7xFgTDshxBiJee956l4OwbKUB22FrZWh5XCPJCVmJ7kn7AWz4HA4sBfSCDtFN+nnMRQL9CT5APofSVHPPR4Plr2fnqledLIuX768du1a+nAkDllUAZjHnhJjROs8fvxYpVLZbDaw+eWXX4pmX4XY7XbRm6w6OzvBq5GDDoFSnpqaCmN5e3s75gnJ1aAxhjJGkm6U39Fseo8AY6YQwvMxk5siHstSPjtQS8gxLoqUTOBhGxcS0lS2tLTs27cv1C6kc+7cuYqKijDqDA0NPX78+IUXXgCb6enpbrebbge8rPfJkye3b9+GhSkpKR6PJ2S/ER49euR0OleuXAk2U1NTMYNhuBq0oRTdMGbTewQYM4UQYsyKFStUKtXQ0FDiv6Avg5EIdkAEV19CNUJCq9XK5fJff/0VbNrt9jAsREVF/fLLL9BCSA8kLlmyRKfTmc1mWPLTTz9t3ryZ3urBgwcej+eDDz5YtWpVYmKiUqkMw7io51qtViaT/fbbb6DQ4XCAD9Kn8vfff79+/brJZAo69qBoNJrR0dHh4WGw6Xa7gXvXr18vKSmJi4tbv379yMiI6CtYROssX75coVDAw6Vwsr755pt169bBzbt374IK4+PjL7/88qNHj0C5w+FISkqayNBUKtX4+DgqPmaQ5CpJk6ANZdJ0wzhy5IjD4dBqtenp6SCbw9OnTzs6OtAYQ/qFhrRvHz16tKGh4Z9//qH7I5F33nknPT09Pj7e4XAcOXJkUmwypg76aQ6Wbl1i3ns0Ef3AwAA8xaZnKUdbhbdWxpMTs2MLvqS1Mp7n9+/fn5+fL7zmL2WtjCfnGKdboCfJh9ATmIt6Dq75w+z99Ez16GQB6uvrjUYjLyCMtTKe53NycoqLi+HNGnARBnDz5s3o6GjRV7CQ6pSVlWVnZzudzt7e3tTUVOy2Lr/fr9Fojh075vP5ent70cskeXl5RUVFbrfbarUaDIampiaJQyCVG43GnJwcl8tls9kMBsPnn3+ONSG5KqqJlIYkTfr7+9Gc06Tl4rnzHgHG9BL8MVo03brEvPc8koie4zilUgmv1NGzlMNWYccY0cTspAsDpABJuneZ1Cm2KZpjnG4haJJ8unGK5+i9y+jN3KKZ6rHJ4nk+LS2tra1N6Ab9WgupcHBw0GQyxcbGij7TjmpCObijunEcV1ZWptVqk5KSwD1jWMOenp5Nmzap1eqUlJSGhgbUk6KiopiYGJ1OJ/onIKgbWLnP5wNDS0pKqq+vF9YRukrRBG1LakjS5KuvvoLXz9DPosz69wgwpp2pSNVQXl4uelEx0kxLYvaZTniTJeW0ZmoMTn3DSBgMuy3HcXq9Htx7hn4mwd4jwIg0U5Hbv7GxcbJeIB8S05KYfaYT9mRNeibNsA1OfcNIGAyv7YIFCy5duvTKK69gn0mw9wgwIs08npCKboZy4sSJhISE/Px8p9NpMpmOHTs2s/LmzlAePnzo9/tXrVo17QanvmEkDE66MwzGdDHbYsx3331XUVHR19eXlJRUVlZ28ODB6faIwWAw5i6zLcYwGAwG47/DVLyjjMFgMBhzExZjGAwGgxEpWIxhMBgMRqRgMYbBYDAYkYLFGAaDwWBEChZjGAwGgxEpWIxhMBgMRqRgMYbBYDAYkYLFGAaDwWBEChZjGAwGgxEpWIxhMBgMRqRgMYbBYDAYkYLFGAaDwWBEChZjGAwGgxEpWIxhMBgMRqT4P2O1HlZy9DwcAAAAAElFTkSuQmCC)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAVxklEQVR4nO2df0wT9//HT6xQakXEUvlRERhBJI4hUYYbMQQXQxghdWGOMYbIjCJhyIw6JMQxJIgMF8cMIQ4XNGYxy0YIIYQZNKRhBBGb2jFTGmQd1sqwYGGVnYjc9493vNznfrx7lBaV7+vx19277/frXu/n3fv96r3vfe9bRlEUAQAAAABuwONlOwAAAAAsWSDGAAAAAO4CYgwAAADgLiDGAAAAAO4CYgwAAADgLiDGAAAAAO5iHjEmLCzszp077nPF5bx2Dr9cQC6AyZ07dw4dOvSyvQBee8TGmD/++GNubu6tt95yqzcu5LVz+OUCcgEscnNzQ0NDX7YXwGuP2BjT2tqanp7u3DH+/vvvVatWOVdWjFle+7TDjx8/3rdvn7+/f3Bw8Jdffvns2TP3ubT4MEVYs2aN03Zouf7999/Dhw9v2LDB29t748aNZ86cef78Ocpz6dKlTZs2eXt7b9q06fvvv2e5sYzB+vXrT5w4wZWamW358uVhYWGnTp2i7S/jw+kaEQs7yxgdCGEpROpAYKVYuA5OV3xycvL06dMEQYyPj+v1+uLiYoeC0EVc6wkvX3zxhbe396VLl1xlkAnvOXWV/5i2s/ShxBEfH3/t2jWRmVmYTCa5XO5cWTwkSQrZpx1OT0/Pysoym80GgyExMbGkpMStLi0ydEVMJpOvr6/Tdmi5MjIy1Gq1wWAYGxvr7OxMSkrq6+ujKOrChQsqlaqtrc1qtXZ1dUVERFRUVLDcIEmSJMnp6Wm9Xp+QkFBWVkb9r9SsbDqdLj4+nraD0g0Gg6+vL/kCp2tELewsC+lAYaUQqQM3J1OKhevgdMWZlxPLgpAgDo+1wJNIY7VaPTw8dDrd7OysSwwyETqnLuko8G1nySMqxlgsFl9f35mZGeeO4e4OnWufdnh6elqlUtntdpTe19cXERGxCC4tGmazOS4uDm3Ex8c7Z4Qpl0Qisdls3DwqlYr5J0Or1cpkMlpYrp7d3d1RUVEUX4xhZYuOjmamLDBYskw5d5YxOlBYKUTqIJSTKcVCdHB5jMEIsmhNya0HEjqnLjkovu0seUSNlbW2tu7atWvFihW7d+/+5ptvUOKdO3e8vLwmJyfR7sGDB48dO/b06dPPPvts1apVGzZs+Oqrr5jDC2fOnFm3bt2aNWv27t3733//ES/uQ8+ePRsWFrZy5cqPPvpofHz82LFj/v7+a9eu3bdv35MnT1DZW7dubd++3dvb29/f/8MPP3zw4AGBvY2lHfb29r5///7KlStR+tDQUFBQEDc/1z7TtzVr1nzyySd0TQmCePjw4fvvv79q1aqwsLCzZ8+iQSruYAg9eMXrv5AdgiAwMrIIDg6+ffs22rh58yZK/O2334Ty82ag5ZqbmyMIQiKRsPJPTk6azeakpCQ6ZcuWLV1dXZhDSKVSkiTxbqBss7Oz4l1dCGJMoTxCOhDzl0KkDoSzUghdWky4lxO6Vk+fPu3v7x8YGHjx4kVUtdDQULvdvmzZsl9//ZVpAXNh0EUuXbrENcsaKRVqU0INgWZ8fJw+0Lfffst1/smTJwcPHvT391+/fv3XX3+NmozIHsbhOf3uu+/CwsLWrl376aefMvsBoX6D6ZtD47yeLyXExhg0WJ+WltbZ2YkS29ra5ubmOjo60G5nZ2dqampFRQUaIujo6NBoNA0NDehXu93e/wKtVltTU0On63S67u5unU5nsViioqKsVqter+/t7TWZTKWlpSibVqs9cODA6OjowMCASqUqLCwU6TCTwcHBo0eP1tbWcvPz2rfb7Xq9vqenp6+vb2RkhHaGIIjCwkJPT8+hoaHOzs7Lly87FFDIfyE7vDL6cxA6XG5u7s6dO1HsYXHr1q2dO3fm5uYyE2m5Vq5cmZqampmZ+fvvv9MBHkkhlUpXrFjBLLVt2zY6eLOYnJwsLy9PTU3Fy/Lo0aOysjK1Wo3Jg6nLfMGbYiojpAMxTylE6kAsQAoxTYP3crLb7QaDYWBgoKmpKTExkSCI1atXGwwGNIK3e/dupgUhQZhFsrOzec0yEWpTDhvU2rVrmb5xj1JUVGSxWLRabUdHR2tra319PX1Ehz0M/pwiC8hni8VSUlKCF5/lm8MLRsjzpYPDOx273S6XyycmJiiKslgsMpkMDbDGx8cfOXIkKyuLoiiTyeTj4zMzM6NQKOh7QDTEjH4lCGJkZASlNzc3b926lU6nb8C7u7s9PDymp6fRbk9PDxrXYjE0NBQQEEAJ39czHaYxm83h4eFXr15Fu5hbYGQf+TY1NUX7Fh4ejrZnZ2elUunw8DBdHTSmwR0M4R3roP0XskNRFK+MZg68/iMFqqqq/Pz89uzZYzQaUaLRaNyzZ4+fn19VVRXzPp0l19TUVElJSWRkpEQiiYiIKC8vn52ddThigORSvMDT0zMrK4s7fMTM5ufnJ5VK8/PzWeP1LN146yIS7oXBa4pXGV4duDad00GMFNzrx6EU3KaB4F5O6OisNkIJtymRgnDNcn/ltilMQxDyjXWU2dlZuVxOW2htbU1ISKBE9zCYc8ryuaenh+4HWDD7DSEFuAh5vpRwHGOam5uTk5Pp3djY2Bs3boyOjqpUKpvNplQqZ2dnGxsbP/jgg4mJCWYD8/PzUyqVFEWZTCapVEpbuHv3Lp2O6ZSZu1qt9r333gsKCkJmWX06yw7LYURCQkJdXR3TOLMI1z7GN4vF4unpyayOwxjD67+QHSEZ58vExIRarZZIJGhXIpGo1WrukDqvXBRFkSTZ09ODHlmbzWbmGeRiMplkMhmKfE1NTQEBAXRLZvUydDaLxcL78JY3NrPqQlGUgoFQCm/z5poSUoarA0VReClE6iBGCqH/KCz/8U2DErichDo+TIwREgT/vA3zK11BoYYg3jeWBaPRyBtrhXoYzDnFW3DYb+CNYzxfSjgeK2ONO6WmpnZ2dra1taWlpa1evTo2Nlaj0aCBMpIkPTw8+vv7dTqdTqfT6/U6nW5BN1kvUKvVO3bs0Gg0Op2uvb19Xg4TBPHw4UO9Xv/555+7xL4TzMu+kIzix8oIgrh3715hYaFGo6moqEApFRUVGo2moKDg3r17zJxCs9K9vLy2b99eV1f3888/ozEKNAeX5vbt28xhEw8Pj+Dg4ODg4L179yoUisbGRl7H6GyBgYHLly/HSyFUF4IgdAyEUkSaElKGqwNBEA6lEKmDq6RweGm5vFWyBFkCiLm8eRHTrp02vnTAh6DZ2VmFQkHfylEU1dPTEx8fn56e3t7eTlFUfX19UVFRQECAxWKhKEoul2u1WpYR1lhZS0sLPVYm5l/G2NgY81+nTqfD3MdwHUaJrBRmEV77GN/Qrb3JZEK79K391NSUh4cHcygA77+QHSEZxY+V5efny+XyI0eOWK1WZrrVai0uLpbL5fn5+UJysaa7aDQaNDigUqk6Ozvp9IGBAcy8sqtXr6pUKu7McjGzdFiXgVBdnABjiquMkA4UVgqROnB3uXDvY7j+O2waCO7l5MR9jJAgC7+PwTQEkb5hxspEjpQInVOMBTH9Bt44xvOlhIMYo9FoNm/ezEpUKpVKpRK1HLPZ7OPjExsbi37Kz89PSEgYGBiwWCw1NTX0HHOCIDIyMsxm88DAQGxsbHl5OTWfK0CpVNbX19tsNqPRqFarWQ1pampKIpEYDIbZ2VlehynOJH1mEV77eN/QuwImk2lgYCAmJob+KT4+fv/+/aOjo0ajMTExEe8/xg6vjOLJzs6mWywXk8mUnZ2NtllyGQwGpVJ54cIFi8Vis9nQr1VVVdT/zvHXaDTR0dGVlZVMm6ymFR0d3dDQQC04xuDr4hDmeXdoilYGowOFlUKkDrw5uc6wulpe/3kvLdblzb2chI5ut9slEonRaBwZGWGO8GAEoYvwVkpMjKGEGwLrARVmHG///v3p6ekjIyMDAwNxcXFoYFx8DyN0TvEWHPYbeOMYz5cSDmLM0aNHS0tLWYlZWVkZGRn07tatW+k8JEkWFxerVCqZTJaamoriM9K9pqZGqVT6+vrm5OSgQWrxV4BGo9m6datUKg0ICDhy5Aj3z1pJSYlMJmtqauJ1mHdomy7Cax/v2+joaFpamlwuDw0Nra6upn8aGhpKTk6Wy+XR0dF1dXV4/zF2eGV0B1y52tvbk5KSfHx8ZDJZTEzMhQsX6J+ampqioqKkUmlkZCSrJXCb1pUrV0JDQ2dmZhYYYxaCmMMJgdGBEpZCpA5ifBOpg9Clxby8uZcT5ujl5eUymayxsVEqlTJnFmAEQUWampqcjjG8DUFIMV7n7Xb7gQMHFAqFSqUSmqCB6WEogXOKt+Cw38Abx3i+lFhGURRmJG3jxo2XL19+++23F2XczgUsvsODg4M7duz4559/XhE78+K1O7/AonH48OGBgYHr168v8nFfSkMA3AfPW2ZMBgcHF8cPV7H4Dut0uvDw8FfHzrx47c4vsGjU1ta6as7OvHgpDQFwHy7+fsz/k/XAT506dfHixUePHt28ebO0tDQ/P//l2nEVz549+/jjj9FfSOa2GODTAEuMFStWbNu2bXGO9ao1BMCVuHboLTY2trq62rU2X0E0Gk1cXJynp2dERMS5c+deuh0XkpOTQ88IYG7j0ev1ISEh7vQLWMq8gg0BcBXzizH455BoYVR6piYrmIWGhtI5SZLMzMzEPPPkzWC1WrOzsxUKRVBQUElJCXeNzpSUFDSHRwhWhuHh4fT0dF9fX6VSuX//ftZbeNwqpKSkoJ8MBkNKSoqPj49SqczLy8O8vsetBabuU1NTAQEBBoOB+5OQqw41cVhNliZarZZ+C4y5jaeysrKwsBBVoaioKCQkBD3erK6uZj7DpJ98RkVFsR6VM3VWqVTMurCeG9PZPDw8QkNDKyoq0CEW4S8UAADzxZVjZXa7XSaTeXl5oV35i6XLSZKsrKyMiYlB6U+fPk1JScEs/yeUIScnZ25uTqfT3bhxo6uri/kaHUEQg4ODWq02JydHyCw3Q1paWlRUlMFg6O3ttVqtBQUFrCLMKpAk2draitJTU1NVKpXBYNBqtSRJ8t7a89YCX/e6urrs7OyNGzdyfxJyFa+Jw2pyNfHz87Pb7dxtPPSLnHl5eSMjI9euXRsZGamvr+/o6NBqtSjPDz/8UFZWVltbazabGxoa6urqTp06RVuQMxa6b29vF6oLM6fdbm9paWlra6uqqiIIgndJfDHOAwDgRuYVkfD3Mcz/m6Ojo/S/foqioqOjm5ub6WyVlZWY2ZO8Gex2u4eHB3PpocjISGapgoICtLiFEKwM3FeoVCqVUHWYkCR57tw5+l1LvV7PKoipBabuU1NTmzdvps0yEXLVoSYOq8kVbb5TjSlxnwagnF0S36FLLlwSHwAAl+M4xpjN5l27dsnl8sjIyKqqKuY7HHl5eXK5PCQk5OTJk5iVE/v6+hQKBWsYR8z7AZj3CVhdic1m8/PzGx0dFbLGmyE6Ovr8+fMURU1PT+fn52dmZrIckMlkRUVF6J3T4uJi7tT1mZmZ48eP5+TkiKwFJrGqqgq9zcALr6t4TRxWk1cTkTGmo6OD3m5oaNizZw/14nU83g9j2Gw2giBY10BfX59QjOnv76cHV/Eu9ff3MyMrVwSmqwAALDKOY4xarc7IyBgZGRkaGtq8eTPdgEtLSzMzM4eHh+/evZuUlHT+/HmhLqmgoKCoqIiV6NoYU1tbi+nohTIMDw/7+PhIpVKJRBIVFcXqHNHQf2lp6djYGKp7bW0tM0Nzc7NEIklKSsJ86U9kjLHb7QqFIjw8PCgoqLS0lBvMeF0VGWOEqsmricMY09fXl5yczHxOk5qaeuXKFbSdnp6elpbW3d3NEtPhUpLMA9lstrS0tIKCAocujY2NpaSkHD9+HCNCQEBAcnJyf3+/0NEBAHAfjtcrk0qlzGX5MevP83ZJJEn6+vryLmLmwhgTHh6u0+kw4yS8GYqKiuLi4vr6+q5du6ZSqRobG1me9/b20rstLS2sD01OT0+jRTUwEw1Expja2lq1Wm21WlEw464nweuqyBgjVE1eTTAdOu8a+GI+DSCkA/OghMCS+FyXCFcviQ8AgPtwEGMsFgtrWX7M+vO8/cjVq1djYmK4ll0YY+jV6YU6Wd4MMzMzMplMr9ej3Z9++gmt1CmEwWDgnWTV3t6OvnYsphZCiZGRkXQgb21tZXki5KqYGCNUVkg0TIzhXQNfzKcBqAUsic91ySVL4gMAsDg4Oa9M/ILhTU1NeXl5zh1FJHV1dcXFxfPNMDExMTMz8+abb6Ld2NhYs9mMPxD64uyzZ89u3bpFJ4aHh1ssFmf8fsHjx4+Hh4fXr1+PdiMjI1kGnXDVYVmHonHhXQNfzKcBiFdvSXwAABYHBzFGqVQSBHH//n20azQa0UZgYKBMJpuYmAh+QWBgILf4gwcPurq6srKyFu6oQqGYnp6mP6ZtNpuRbwRBdHV15ebm+vv7x8XFTU1Ncb+twpth3bp1EomE7i4NBkNoaCiz1PXr17ds2ULv3r17F2WYm5t75513Hj9+jNKNRmNISMhCqiaTyebm5v766y/aE5ZBIVcxmjgs61A0LidOnDAajUqlMjY2Fq3m8Pz587a2NmaMYX0VgyRJNFF79erVKpVKo9HQP/355587duzgPVBZWVlNTc3Tp0/x/ojk0KFDsbGxAQEBRqPxxIkTLrEJAIBYHN7poGf+9LL8mPXnWeuBUxRVXV2tVqt5zc53rIyiqJSUlOzsbIvFglbOpyfd0t9T6e3t9fHx4X5bRShDYWFhcnLy8PCwVquNjIxkTeuy2WwKheLkyZNWq1Wr1TIfk6SlpWVmZprNZp1OFx0dXV9fL74WvIlqtTolJcVkMun1+ujo6B9//JFVRMhVIU0clhXSZGhoiLmMtNCXPND7/+I/DUA5uyQ+hR2+4/VNzJL4AAAsDvObu1xbW4tZf54kSdZ64FFRUS0tLbxmHXYc3MSxsbGsrCw/Pz+hd9rp/kWoJ2J1QCRJFhYWKpXKkJAQNGeMVbC/vz8xMVEul4eHh9fU1DA9yczM9PX1ValUmI5SfKLVakVVCwkJoRfjYWbjuorRhGVfqCyvJr/88gv9/Iy5zcu8Pg1AObUkPrXgGAMAwEvExYttFBUV8T4BxiPyXb9FMLgQT5ZALUiSDA0NRRPPmNtCREZGMqfeAQAAsHCwtv98cXo9cNazkIXjtMGFePK618LLy+vKlSvvvvsua1sI+DQAAAB4HHyjbHEYHx+32WxvvPHGSze4EE+WRi0AAABcyCsRYwAAAIAliYu/UQYAAAAANBBjAAAAAHcBMQYAAABwFxBjAAAAAHcBMQYAAABwFxBjAAAAAHcBMQYAAABwFxBjAAAAAHcBMQYAAABwFxBjAAAAAHcBMQYAAABwFxBjAAAAAHcBMQYAAABwFxBjAAAAAHcBMQYAAABwFxBjAAAAAHfxf++UZ5upQuq2AAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAF9klEQVR4nO3b30tTfRwH8M9mbHMda7PNNpypeVEX0ZVEQnTVhYwIu3BJjQoKC7GSXXQhlKuoJOkmxLzoIvsDxpAIr7qQCFpjDkkRjZrzxyRlslrrbLnzfS7O8xzG3I4beXLPeL+uzjn78jnf9y7O5+x8d1SMMQIAAFCAeqcnAAAAZQs9BgAAlIIeAwAASkGPAQAApaDHAACAUtBjAABAKegxAACgFPQYAABQyhY9Zn5+vqqq6u9MpXCxWOzx48fS7urqant7u9FoVKlUKpXKarXeunUrmUyKn5ZmBNqUYtvHAwDsONWW7/knk0mtVvt3ZlOg+fn5I0eO/PjxQ9w9e/asIAjPnj2zWCxEFAqFurq6Tp482dfXJw4owQi0KcW2jwcA2HFbPysrwatzpt+/f79+/frFixf19fVarVar1R46dOjRo0cej0caU+IRAADKVaHPysSNp0+fNjY2Go3GCxcuxGIxcczPnz+vXbtmNpvr6uru3buXTqeJ6Ny5cw8fPpTqtLS0jIyMENHHjx9bWloqKyvNZnN7e/vS0pJMZSJKJpNXrlypqqqqr6/v6+tLp9OxWKyhoSEej6tUqpGRkZWVFY1GYzabiejDhw9NTU1Go/HNmzeLi4uFR8iZovAI8sU3RyCirBRZX/jAwMD+/fuNRuOlS5d+/folMx4AoJQVseYfj8cnJyffv3/v8/nC4XBvb694/ObNm8vLy4FAYGxsbHR0dGhoiIgcDofX6xUHRCKRYDDY1tZGRIFAoLOzc2Vl5dOnTzabrbu7W6YyEd2/fz+RSExOTo6NjY2Pjw8PD+/du3dmZobjOJ7nnU6nIAhq9b8puru7HQ7H7OxsIBAQBKHwCDlTFBVBpvjmCESUlSJrkj6fz+/3+/3+QCDw5MkT+fEAAKWLyQqFQhzHiRtE9P37d/H4u3fvDh48yBjb2NjgOO7Lly/i8dHR0ePHjzPGEonEnj17wuEwY2xoaOjMmTObi3/+/NliseSrLDKZTPF4XNwOBoPHjh3LnFXmdiKRUKvVa2trjLG3b98aDIYCI+RLUXgE+eI5I2SlyPzCiUg8KWPM4/E0NzfLjAcAKGW7Cu9GHMdJf9Cy2WzRaJSIvn37lkqlGhsbxeOHDx8Wr5KVlZV2u93r9d64ccPj8Vy+fFkcMDExcfv27enp6VQqJQiC+GsjZ2UiWl9fX1tba2hoEHcFQdi1K++Eo9GoRqPZt2+fWKTwCPlSFBUhX/GiIoh0Ol1dXZ00k3A4LD8eAKBkFdFjiuVwOAYHB51Op8/nk1bg29rarl69Ojw8rNPpFhcXW1tbZSrwPK9Wq/1+v3Rdlh6LbZb50Czng7LSjwAAUGb+9HpXU1Oj0Wi+fv0q7s7MzEj37Ha7PRgMvnr16tSpU+IN/urq6vLy8p07d5qammpra3U6nXxxq9Wq1+uj0Wjtf6xWa3YAtVrsKNXV1TzPr6+vE1Gx9/75UvydCFl4nl9YWBC3Z2dnDxw4UFQWAIDS8ac9pqKioqOjo6enZ2FhYWpqyu12nz9/XvxIq9W2trbevXu3o6NDPGI2m6urq58/fx6Lxebm5txu95b1nU5nV1fX1NRUJBIZGBh48OABEZlMJp7n5+bmxO1UKjUxMbF79+4TJ0709/dHIpHBwcFtSaFchKwURCS9NEpELpdraWlJnMnp06dzjgcA+B+QX67JXDDPXHAOhULSono8Hu/s7DSZTDabze12b2xsSMO8Xi/HcYlEQjoyPj7e3Nys0+ksFovL5TIYDDKVGWM8z/f09NhsNr1eb7fbpWV5t9ut1+tfvnzJGHO5XNevX2eMTU9PHz161GAw9Pb25lzzlzlRvhSFRJAvni9CZoqsSfb399fU1BgMhosXL2aeOjM1AEDp2/o9//+FdDpdUVGx07PYBniZHwDKSZmsP5dHgwEAKDNl0mMAAKAEoccAAIBSymQ9BgAAShB+xwAAgFLQYwAAQCnoMQAAoBT0GAAAUAp6DAAAKAU9BgAAlIIeAwAASkGPAQAApaDHAACAUtBjAABAKf8AO1G4CljIvbEAAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 27 May, 2020 11:56 GMT
Vulnerability Verified: 27 May, 2020 12:04 GMT
Website Operator Notified: 27 May, 2020 12:04 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 27 May, 2020 12:04 GMT
Vulnerability Fixed: 26 June, 2020 19:34 GMT