gramho.com Cross Site Scripting vulnerability OBB-1192638

2020-06-1114:47:00

1orzero

www.openbugbounty.org

JSON

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	gramho.com
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	1orzero
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAL5UlEQVR4nO2cb0xT1xvHj1hqh7co9RYUaixkQV8YRox/Ixr/xbmNkDoV2ewmbsYxwxAJGuWFIkYkCIahIb7AxS1kS8xCmi4xmlRiGkYYsubaNQwbNKWphZHCirli1crdi5Pf/V3vvxZKoejzedXn3HvP+Z7vOec+954W5jAMgwAAAAAgCsTNtAAAAADgrQVyDAAAABAtIMcAAAAA0QJyDAAAABAtIMcAAAAA0QJyDAAAABAtYjfHpKenP3jwQCp8Z4lNH2JTFTAJHjx48O2330odffXq1WefffbPP/9MpyRgVhOjOeavv/4aHx//4IMPRMN3ltj0ITZVAZOjsLBQr9dLHY2Pj1cqleXl5dOoCJjdhMgx/f39arVa9NDo6OjFixelwggxm815eXlSYbSR6fXMMs0+oPCswKrYM/v7+5OSkqIt7MqVK+np6fPnz1+3bt3du3cjrzAagz49VkQId+UODw/b7fbS0lKEUH9//5w3+eijjxBCpaWlFotlJhUDs4rJv8f4/f7q6mqpMEJmNsfELLHpw/SrunLlSkNDww8//OB2u0+ePFlQUPD7779Pp4C3Ce7KpWk6ISFh3rx5OCQIIsDBbDYjhDQaDU3TMyYXmG0oZlqACAMDA06nc8uWLaLhO0ts+sCqGhoayszMRAgpFAr8IXrU1NS0tLRs3boVIbRnzx6fz1dTU/Pbb79FtdF3EzbfAMDkCOs95vvvv09PT1+0aNEXX3wxOjqKEBodHdXr9TRNz5kz58cff+SGly9fVqvVly5dSklJSUpKOnjw4PPnz3E99+/f37Rpk1qtTktL27Nnz99//y3anNls3rlzZ3x8vDAcGBj45JNP1Gp1enp6fX093ojAuxwXL17UarVLliy5fv06bmvDhg3vvfeeVqvdt2/fkydP2DPr6+vxNsv+/fuHh4dPnDih1WoXLVp06NChZ8+eyfQaIfTs2bNvvvlGq9UuXbr03Llzr1+/Fup//fr16dOnU1JS5s+fv2/fvuHhYakLJ6SH64OUky9evPj666/VavWyZcvOnj2LW5GxgmeaqHIpK3iq0tLS/vzzT4RQWlraH3/8gY/euXNHfmpxTxB2av/+/RcuXGBP2LBhA55sXq83JyeHLf/qq6+uXr3Kqzmk4UlJSQcOHOB1RxSpQRc19smTJx9++KFarV6+fPnPP/8sXzPWI1wsoqMTyRSSaoi3kHnyxsfHjx07lpKSkpKScvz4cdHZHnKIgXec0DmGpmmKojo6Orq6urxe76lTpxBCCxYs6O3txa/SRqORG+7evZum6a6uru7u7u7ubpvNVltbi6vKzc0tLCx0u93t7e05OTkqlUq0RZmNsuLiYqVS2dfXZ7FYfvrpJ67I3t5eh8Nx48YNfPex2WxHjhwZHBx0OBw6na64uJjbnfb2doqivF7vihUrfD6f3W7v7Ox0uVwVFRUyvUYIlZSUeL1em812+/Zts9nc1NQk1F9bW2uxWCwWi9PpTE1N7enpkbkwTD08H6ScrKqqGhsbs9vtt2/ftlqt165dk7eCZ5qocikrRAeLR2Fh4fbt23Hu4XH//v3t27cXFhayJcJO5efnm0wmfHRgYICiKIPBQNO0SqViH0EQQvHx8cuWLePVL2O43W7H3XG73VyHpZCqStTY4uLixMTEnp6eW7ducXOMVgCrR3SxCEcnwikk2hBvIfM6PjY2RhCEw+Ho6OiwWCwNDQ1Cc2SGGAAQQoiRxeVyIYSePn2Kw46OjoyMDPYQQRDcM3GIL3G73bi8tbV19erVDMOMjIwoFIpAICBsxe126/V6/JmmaYIgRkZGhGEwGFSpVI8fP2ZrXrhwIdsie4mQvr6+xYsXs2f6/X5c3t7eHhcXNzY2xvbu/fffl+l1MBgkCIIVYDab169fL2wuOTnZZrNxS6QuDFMPzwcZJ0mSpGkaf6Yoau3atfJW8EwTKpeZAIxgsITQNF1dXa3RaPLz851OJy50Op35+fkajaa6uppVK9qpsbGxxMREPJeampry8vKYNydeeXk5SZIkSXJVMaEMZ7vT3t4uNZ9DVsUDG4unKHfy4ynKMIxHACO9WISjE+EUkmqI13Hu50Ag0NnZyQowmUx4OvGMEh1iAGAJnWN4iYRdMzI5RqVSseU9PT3Jycn4c0FBQXZ2dllZWV1d3b1799hzgsGg1+vFn1tbW7dt28Ye4oZer1epVHJrZnOM8O5gs9l27NiRmppKkqRGoxE9k9sdbih1Gk+A0+nE92sufr9foVAEg0FuodSFYeoR2iLq5MjICEKI/B8ajQY7H44VUsrlFfJUSTEyMmIwGBQKBQ4VCoXBYGBvi/KdKigoaGxsZBhmx44dLS0tDMN4PB52gvn9fo/H09nZyVXFTMpwqRwjM+hCY71eL2/y84TxkFosQjERTiGZVSmVY3j09vaKtojhDTEAsEzr38f88ssvzc3NWVlZL1++LCsr++6773D53LlzlyxZgj9P1S/KDAbD5s2brVYrRVG3bt2KXPyEmDt37tRWyPNB1MlAIBAXF9fd3U1RFEVRdrudoig0QSsmpDyc0Xn06FFxcbHVaq2qqsIlVVVVVqv16NGjjx494p4p2im8Xfbvv/92dXXhtvDGzqtXrxBCCxYsSEtLUyqVCQkJ4cueKiZkrNRe2SxifHxctFw4xADwf+RT0OTeYxDnrdxkMrFv5VwoitLpdLzCYDBIkiS7ISAMVSqVy+XCIXevjPdgNTQ0xH2koihqSt5jwt8royiK1y+pjY5w9PB84MF1kiAI3mZXmFZIKZdRKK8KU1RURBBEWVmZz+fjlvt8vtLSUoIgioqK5DsVCAQ0Gk1DQ8Onn37KHk1NTeW+B9fV1e3atYt7+SQMn+hemaixvL0yk8k0ob0ydrEIxUQ4hWRWpdR7jMViyc7OZqtqbW0V3SuTGmIAwEw+x9A0rVAo2B1YNsSzee/evR6Px+FwZGdnV1ZWMgzT09Oza9eutrY2n8/ndrsPHz6cm5vL1ow34q1W68qVK9lCXsgwzN69ew0Gg8vlcjgcWVlZ8rfLpqYmv9/vdDoNBsOU5BiGYQ4fPpyXl+d2ux0Ox6pVq/A2DqsfU11dvXbtWrvd7vF48POd1IVh6uH5IONkUVHR+vXrHQ6H1+utra2tqqoK0wop5TIKhaMjxGg0ss8EQlwul9FoDNmpzz//PDEx8ebNm+yFjY2NGRkZbW1tQ0NDLS0tGo2mo6ODV/lEDceHAm+Cdw6lBl3UWIPBwJ38IffKRBeL6OhEMoWkGmLeXMhut5u7D0mS5JkzZ3w+n81mW7lyJW6xr6+P24T8EAPA5HMMwzCVlZUJCQk3btzghvX19QRB1NTUJCcnL1y48Msvv8TfQL58+bKysjIzM1OpVCYnJxuNxsHBQV4r5eXlFRUVbP28kGGYwcHB3NxcgiD0en1NTY3M7dJqta5evVqlUi1evLisrGyqcgxN00eOHCFJUqfTVVZW4nsQ7/xgMHjy5EmSJFUqlcFgwM934VwopYfng4yTgUCgtLRUp9MlJCR8/PHH+LE3HCuklMsoFI5OJMh0ymQyEQTBfo+NaWxs1Ov1SqVy1apVbW1twgonaji+C/O4du2aVFWMhLEej2fnzp0EQWRmZtbV1YXMMaKLRXR0IplCUg1h2IUcCARUKhX74Njd3Z2Tk0MQREZGRm1tLS789ddfs7KyZDoFAFxC5JhJIPO1YUgyMzO5P2XhhTx6e3vZ7y3fbuR9mCliU9XsIpLFEqWGSkpKZH7HEQgE9Hp9c3Pz1EkD3nJi6+/8Hz58KBPyoCgqIyMjyopiAnkfZorYVAVESF1dHf6piCjz5s1raWnZuHHjdEoCZjWxlWNCcv78+dTU1Ly8vMePH1dUVJw5c2amFQHAW0V8fPyaNWtkToAEA0yIGP3f/lJs2bKlqalJp9MZjcaSkpKDBw/OtCIAAABAkjkMw8y0BgAAAODtZJa9xwAAAACzCMgxAAAAQLSAHAMAAABEC8gxAAAAQLSAHAMAAABEC8gxAAAAQLSAHAMAAABEC8gxAAAAQLSAHAMAAABEC8gxAAAAQLT4D62F5+GZjadnAAAAAElFTkSuQmCC)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAL5UlEQVR4nO2cb0xT1xvHj1hqh7co9RYUaixkQV8YRox/Ixr/xbmNkDoV2ewmbsYxwxAJGuWFIkYkCIahIb7AxS1kS8xCmi4xmlRiGkYYsubaNQwbNKWphZHCirli1crdi5Pf/V3vvxZKoejzedXn3HvP+Z7vOec+954W5jAMgwAAAAAgCsTNtAAAAADgrQVyDAAAABAtIMcAAAAA0QJyDAAAABAtIMcAAAAA0QJyDAAAABAtYjfHpKenP3jwQCp8Z4lNH2JTFTAJHjx48O2330odffXq1WefffbPP/9MpyRgVhOjOeavv/4aHx//4IMPRMN3ltj0ITZVAZOjsLBQr9dLHY2Pj1cqleXl5dOoCJjdhMgx/f39arVa9NDo6OjFixelwggxm815eXlSYbSR6fXMMs0+oPCswKrYM/v7+5OSkqIt7MqVK+np6fPnz1+3bt3du3cjrzAagz49VkQId+UODw/b7fbS0lKEUH9//5w3+eijjxBCpaWlFotlJhUDs4rJv8f4/f7q6mqpMEJmNsfELLHpw/SrunLlSkNDww8//OB2u0+ePFlQUPD7779Pp4C3Ce7KpWk6ISFh3rx5OCQIIsDBbDYjhDQaDU3TMyYXmG0oZlqACAMDA06nc8uWLaLhO0ts+sCqGhoayszMRAgpFAr8IXrU1NS0tLRs3boVIbRnzx6fz1dTU/Pbb79FtdF3EzbfAMDkCOs95vvvv09PT1+0aNEXX3wxOjqKEBodHdXr9TRNz5kz58cff+SGly9fVqvVly5dSklJSUpKOnjw4PPnz3E99+/f37Rpk1qtTktL27Nnz99//y3anNls3rlzZ3x8vDAcGBj45JNP1Gp1enp6fX093ojAuxwXL17UarVLliy5fv06bmvDhg3vvfeeVqvdt2/fkydP2DPr6+vxNsv+/fuHh4dPnDih1WoXLVp06NChZ8+eyfQaIfTs2bNvvvlGq9UuXbr03Llzr1+/Fup//fr16dOnU1JS5s+fv2/fvuHhYakLJ6SH64OUky9evPj666/VavWyZcvOnj2LW5GxgmeaqHIpK3iq0tLS/vzzT4RQWlraH3/8gY/euXNHfmpxTxB2av/+/RcuXGBP2LBhA55sXq83JyeHLf/qq6+uXr3Kqzmk4UlJSQcOHOB1RxSpQRc19smTJx9++KFarV6+fPnPP/8sXzPWI1wsoqMTyRSSaoi3kHnyxsfHjx07lpKSkpKScvz4cdHZHnKIgXec0DmGpmmKojo6Orq6urxe76lTpxBCCxYs6O3txa/SRqORG+7evZum6a6uru7u7u7ubpvNVltbi6vKzc0tLCx0u93t7e05OTkqlUq0RZmNsuLiYqVS2dfXZ7FYfvrpJ67I3t5eh8Nx48YNfPex2WxHjhwZHBx0OBw6na64uJjbnfb2doqivF7vihUrfD6f3W7v7Ox0uVwVFRUyvUYIlZSUeL1em812+/Zts9nc1NQk1F9bW2uxWCwWi9PpTE1N7enpkbkwTD08H6ScrKqqGhsbs9vtt2/ftlqt165dk7eCZ5qocikrRAeLR2Fh4fbt23Hu4XH//v3t27cXFhayJcJO5efnm0wmfHRgYICiKIPBQNO0SqViH0EQQvHx8cuWLePVL2O43W7H3XG73VyHpZCqStTY4uLixMTEnp6eW7ducXOMVgCrR3SxCEcnwikk2hBvIfM6PjY2RhCEw+Ho6OiwWCwNDQ1Cc2SGGAAQQoiRxeVyIYSePn2Kw46OjoyMDPYQQRDcM3GIL3G73bi8tbV19erVDMOMjIwoFIpAICBsxe126/V6/JmmaYIgRkZGhGEwGFSpVI8fP2ZrXrhwIdsie4mQvr6+xYsXs2f6/X5c3t7eHhcXNzY2xvbu/fffl+l1MBgkCIIVYDab169fL2wuOTnZZrNxS6QuDFMPzwcZJ0mSpGkaf6Yoau3atfJW8EwTKpeZAIxgsITQNF1dXa3RaPLz851OJy50Op35+fkajaa6uppVK9qpsbGxxMREPJeampry8vKYNydeeXk5SZIkSXJVMaEMZ7vT3t4uNZ9DVsUDG4unKHfy4ynKMIxHACO9WISjE+EUkmqI13Hu50Ag0NnZyQowmUx4OvGMEh1iAGAJnWN4iYRdMzI5RqVSseU9PT3Jycn4c0FBQXZ2dllZWV1d3b1799hzgsGg1+vFn1tbW7dt28Ye4oZer1epVHJrZnOM8O5gs9l27NiRmppKkqRGoxE9k9sdbih1Gk+A0+nE92sufr9foVAEg0FuodSFYeoR2iLq5MjICEKI/B8ajQY7H44VUsrlFfJUSTEyMmIwGBQKBQ4VCoXBYGBvi/KdKigoaGxsZBhmx44dLS0tDMN4PB52gvn9fo/H09nZyVXFTMpwqRwjM+hCY71eL2/y84TxkFosQjERTiGZVSmVY3j09vaKtojhDTEAsEzr38f88ssvzc3NWVlZL1++LCsr++6773D53LlzlyxZgj9P1S/KDAbD5s2brVYrRVG3bt2KXPyEmDt37tRWyPNB1MlAIBAXF9fd3U1RFEVRdrudoig0QSsmpDyc0Xn06FFxcbHVaq2qqsIlVVVVVqv16NGjjx494p4p2im8Xfbvv/92dXXhtvDGzqtXrxBCCxYsSEtLUyqVCQkJ4cueKiZkrNRe2SxifHxctFw4xADwf+RT0OTeYxDnrdxkMrFv5VwoitLpdLzCYDBIkiS7ISAMVSqVy+XCIXevjPdgNTQ0xH2koihqSt5jwt8royiK1y+pjY5w9PB84MF1kiAI3mZXmFZIKZdRKK8KU1RURBBEWVmZz+fjlvt8vtLSUoIgioqK5DsVCAQ0Gk1DQ8Onn37KHk1NTeW+B9fV1e3atYt7+SQMn+hemaixvL0yk8k0ob0ydrEIxUQ4hWRWpdR7jMViyc7OZqtqbW0V3SuTGmIAwEw+x9A0rVAo2B1YNsSzee/evR6Px+FwZGdnV1ZWMgzT09Oza9eutrY2n8/ndrsPHz6cm5vL1ow34q1W68qVK9lCXsgwzN69ew0Gg8vlcjgcWVlZ8rfLpqYmv9/vdDoNBsOU5BiGYQ4fPpyXl+d2ux0Ox6pVq/A2DqsfU11dvXbtWrvd7vF48POd1IVh6uH5IONkUVHR+vXrHQ6H1+utra2tqqoK0wop5TIKhaMjxGg0ss8EQlwul9FoDNmpzz//PDEx8ebNm+yFjY2NGRkZbW1tQ0NDLS0tGo2mo6ODV/lEDceHAm+Cdw6lBl3UWIPBwJ38IffKRBeL6OhEMoWkGmLeXMhut5u7D0mS5JkzZ3w+n81mW7lyJW6xr6+P24T8EAPA5HMMwzCVlZUJCQk3btzghvX19QRB1NTUJCcnL1y48Msvv8TfQL58+bKysjIzM1OpVCYnJxuNxsHBQV4r5eXlFRUVbP28kGGYwcHB3NxcgiD0en1NTY3M7dJqta5evVqlUi1evLisrGyqcgxN00eOHCFJUqfTVVZW4nsQ7/xgMHjy5EmSJFUqlcFgwM934VwopYfng4yTgUCgtLRUp9MlJCR8/PHH+LE3HCuklMsoFI5OJMh0ymQyEQTBfo+NaWxs1Ov1SqVy1apVbW1twgonaji+C/O4du2aVFWMhLEej2fnzp0EQWRmZtbV1YXMMaKLRXR0IplCUg1h2IUcCARUKhX74Njd3Z2Tk0MQREZGRm1tLS789ddfs7KyZDoFAFxC5JhJIPO1YUgyMzO5P2XhhTx6e3vZ7y3fbuR9mCliU9XsIpLFEqWGSkpKZH7HEQgE9Hp9c3Pz1EkD3nJi6+/8Hz58KBPyoCgqIyMjyopiAnkfZorYVAVESF1dHf6piCjz5s1raWnZuHHjdEoCZjWxlWNCcv78+dTU1Ly8vMePH1dUVJw5c2amFQHAW0V8fPyaNWtkToAEA0yIGP3f/lJs2bKlqalJp9MZjcaSkpKDBw/OtCIAAABAkjkMw8y0BgAAAODtZJa9xwAAAACzCMgxAAAAQLSAHAMAAABEC8gxAAAAQLSAHAMAAABEC8gxAAAAQLSAHAMAAABEC8gxAAAAQLSAHAMAAABEC8gxAAAAQLT4D62F5+GZjadnAAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABzCAIAAADBrEUFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAYZ0lEQVR4nO3df0wb5/0H8AsYx3GMAceYxNBh3AWyDDGGupSkjLI1YpShyKNpyjbaMBYxVlHiRTQiWcQo3ShlpCJOhBDKJhaxbKo65DGJNZqLItdFKWXI9RBlKEWGOQ5lhELiMBcc7vvHo933dvadD8gRSN6vv3zPnZ/nuc+d/fH98HNbaJqmAAAAJBDxoDsAAAAPLeQYAACQCnIMAABIBTkGAACkghwDAABSQY4BAACpIMcAAIBUkGMAAEAqYXLMlStXYmJibt26xZQ89dRTP//5zymKunPnzvHjx5OTk7dt25aWlvbmm2/eu3dPoJzj/Pnzjz/++NatW7/+9a//9a9/Zc+amJiIjIx8//33OYVxcXHM5GeffRYdHf3JJ58wJb///e/T0tKYtvjqn5iYiI6O5qt5YmJiC8tjjz126tSppaUl9vIvvvji8ePHmcn3338/Kipqfn6eKXn66afPnTsXXBsRchanIb4YsjsfXPOWLVuEGwUAWG90OIWFhdXV1eR1d3e3Xq/3+Xw0TR8+fNhkMo2Ojk5PT9tstry8vIGBAYFyNovFYjAYbDbb9PT05cuXNRqN3W5n5rrdboqijEYjaYgpjI2NZVdiNptfeuklZjIjI6OzszNs/W63W6VSseth10zm+v1+v9+/sLDgcrmys7PPnDnDXr6joyMrK4uZrKuroyiqu7ubTC4uLioUCqfTyamNEQgEghsaHh4+cOAA0xBfDNmdJ+8dHR2NjY1lKhduFABgnYXPMaOjo0qlcnx8PBAIpKamku/xhYUFmUw2NzfHWZivnEOv1/f19TGTra2tRUVFzKTb7VYqlVlZWZWVlexCTo7xer0qlcrtdtM03dvbazQamW9SgfrF5Bj2XIfDsWfPHnbJ2NiYTCa7ffs2mTxw4EBGRkZVVRWzvEBt7EY5s/r7+0lDAjEU7nzYRgEA1ln46zFpaWkVFRW1tbUdHR1qtfro0aMURS0vL1MUJZPJOAvzlbPNz897vd6cnBymJDc3d2RkhL1MRETEpUuXOjs7//a3v/HVs2vXrrKysubmZoqimpqaamtrIyMjRdYvnkKh8Pv97JLdu3frdLr+/n6Kou7cuTM0NPTLX/7SZrORuQ6HIzc3dxUNyeXyxcVFSlwMAQA2BVHX/Ovq6vr6+k6fPm2xWEjJ9u3bCwsLS0pKPvjgg7t37zJL8pWz+Xw+hUIRFRXFlKjV6tu3b3MW++pXv1pfX19eXs6+1MFRW1t7+fLlP//5z263u6ysbEX1izE/P19fX19YWMgpz8vLczgcFEVdvXo1MzOzoKDA4/HcuHGDoiiHw5GXl7fShj7//PO6urpjx45R4mIIALApiMoxcXFxBw8eVKvV+/fvZwq7urrS09PLy8tjY2N379792muvkevSfOWMQCDA+ZEeERERCASC262pqUlKSqqurubrWGJiYklJSUlJSW1tLZNUxNcfks/ni/8vnU6nVqvJoRIbk2P6+vry8/OjoqLy8vLIoUx/fz/7OIZdW3x8/CuvvBI8a8eOHVqtdnl5+dSpU2RW2BiKXwVOowAA60rMCTWXyxUbG5uent7e3h481+/39/f3B18b5yv3eDwKhYJdcv36da1Wy0yyryiMjY0plUqr1Rp84YHpGzmdJbL+sNdjlEqlx+PxeDydnZ07d+5cWFgIbpRco1pcXExPTyd3E1gsltLSUpfLpVarmctC7NqI2dnZkLPsdntWVlZrayunIU4MRV6P4WsUAGCdicoxeXl5DQ0NV69e1Wq1fF9YAwMDqampYsrn5uYoilpcXGRKhoaGjEYjM8n5Jm1tbdXpdIODgyFzTPDXrnD909PTMpmMfZ/V8PCwXq8PWVt6errFYgm5vnq93mq1qtVq0tDIyIher29rayssLBTom8Ash8MRMoA0K4a45g8Am0v4c2V/+tOfxsfHa2pqnn766ZycHHKrLkVRnEsF5AZZgXJGTEyMXq8n55oIh8Oxd+9evg4cP3587969VVVVYbsqpv74+HiNRnPt2jVmrt1uz8jICFnVmTNnmpubv/jii+BZubm59fX1ubm55BzdV77ylYiIiI6OjlVcjCFI5iOvw8YQAGBzEE5BCwsLBoOhq6uLTJIzVy6Xa3R0VKfTdXR0eL3eubk5u92enp7e2NjIV86plvn/yszMzB//+Mfg/8dwfomPj4+rVCqRxzFh679w4UJqaqrdbp+ZmXnnnXc0Go3D4eCrbe/evSHPELa3t1MUxT7KITcdsP8MJPL/MX6/f2RkJDc39+WXX6ZpWiCG4o9j8P8YANgIwuSYhoaGffv2sUvMZnNeXh5N0729vXl5eWq1WqlUZmRkdHR0kAX4yjksFovRaJTL5ZmZmb29vexZIdNGe3u7+BwjXD9N02+99ZbBYJDL5enp6czfJ0PW1tXVZTAY2GfeiNHRUYqiRkZGmJLLly+rVCr2tzn5MykHuejCmaXT6SoqKpj/3PDFUGSO4WsUAGCdbaFp+r4fGwEAAFAYExMAAKSDHAMAAFJBjgEAAKmIyjEC4+Qzo8dHRkampKS8/vrrzCj0AsPahx26nxFyBHvh8fmFW+dbhjO6vnD/Oa2HjZX4xwFwqkpJSdm+ffuTTz753nvvcTpP+vDss8+++eab7FlXrlxJTEwMuwoiN8FaHoUgHCgAeCSEvSsg7Dj5zAD1Tqdz3759DQ0NdLjbdikRQ/cTIUewD3t7lZj7d4VH1w972/GKYiX+cQDsqoxGY19fH7nBWqvVMjdYs/vQ0dGRnZ3NfmNlZSW5B/q+bIK1PAoB/wYFgPA5ZkXj5JN/O4acxRA5dD/nLcEpZEULhKyTb3T9sP3nm8UXK/GPA+Crqr29nfP4A9KHqakpmUw2NTXFfqPNZgu7CiI3wVoehYAcAwBhzpWtdJx8hUIh5h/pYobuX3/M6PqrIxCrlT4OILiq8vLyCxcuBDeakJCQnZ1ttVrJ5Icffuj3+8WMNSDRJgh+FAIAPMrC5JgVjZP/73//+8yZMyaTSUzDYobuX0/s0fVXRzhWK3ocQHBVUVFRycnJIdstLi5mcozVai0qKiLP0Qnrvm8CvkchAMAjK0yOCTtOPnuA+i996UsGg6GhoYEzi2+E+bBD9wvgVJ6VlSW8QMjx7QVG1xdZA5twrMQ/DoBT1auvvko68Pjjj4dst7i4+OrVq3fu3KEoymq1FhcXi1+FtWyC4Cb4HoXA8a9//SslJWXVLQLAJhLmYYvsgRqJ5eVl9jepUql0Op0URUVEROh0OvYvaGYWM8mpPDIy8tKlS5mZmcXFxZmZmSvqN6dyj8dTUFAgsEBw65xlxsfHzWbzuXPnmBvAxNTAJhyr3Nxcs9m8tLRks9na2tooisrPz7fZbFlZWYFAgLP67KrOnDljNpuDV5CRnJy8Z8+e3t7ezMxMj8eTn58vPghr2QScJmw2W21t7cWLF7dt2yb8Fr1eT04bAsBDL0yOIXcNLS0tMedtbt++rVarmQUiIiLInbLBBGYxdu/e3djYWFFR0dvbu5JucysPvggkpnX2MomJiRaLpby8nMkxYmpgE45VWlpabGxsb2/v5ORkdnY2RVEHDx5samo6cOBATk4O5+wWu6qYmJiYmJjp6WmBJEdOl7nd7oKCAvZX/No3gVKp9Pv99+7dY3ro8/nYPWGaOHr0aEtLy8WLF8Me8EVGRu7atUt4GQB4OIQ5V7bScfhXYaVD90sn+EBkRcLGSvzjAEhV7B/7fX19fA8goCiquLi4t7f37bffFnkxjENgE9yvRyEAwCMq7J1nAuPkh73BV+T/SwSG7mdqW8W9y+L/H8MZXV9M/0POEn6mgJjHAbDDTv4fMz093dXVpdFo+vv7BSKQmpoql8vn5ubu+yZY9aMQBDrgZz23FAAeYqKeg8k3Tr5wjgnOZ8yw9uKH7mdqW2mO4WudbxnO6Prih+UnmC9WgWcKiHkcABvJWHK5PCsri/1fmZAROHnyZEFBgcAKrmUTrO5RCHyBwv9mAB4dGNsfAACkgjExAQBAKsgxAAAgFeQYAACQCnIMAABIBTkGAACkghwDAABSQY4BAACpIMcAAIBUkGMAAEAqyDEAACAV5BgAAJAKcgwAAEgFOQYAAKSCHAMAAFJBjgEAAKkgxwAAgFSQYwAAQCrIMQAAIBXkGAAAkApyDAAASAU5BgAApIIcAwAAUkGOAQAAqSDHAACAVJBjAABAKsgxAAAgFeQYAACQCnIMAABIBTkGAACkghwDAABSQY4BAACpIMcAAIBUNm6OSUlJ+fjjj/kmH1kbMw4bs1ewCh9//PFPf/pTvrlLS0vf//73P/vss/XsEmxqGzTH/OMf/1heXv7a174WcvKRtTHjsDF7BatTVlZmMBj45kZFRcnl8pqamnXsEWxuYXLMxMREdHR0yFnz8/NvvPEG3+Qa9fT0HDp0iG9SagJr/WCtcxwocaEgvWKWnJiYiIuLk7pj58+fT0lJ2b59+5NPPvnee++tvUIpNvr6hGKN2J/cW7duuVwus9lMUdTExMSW//Xss89SFGU2m20224PsMWwqqz+OmZuba2xs5JtcowebYzasjRmH9e/V+fPnW1tbf/vb305OTp48ebKkpOSDDz5Yzw48TNifXJ/Pp1Qqt27dSiZVKpWfpaenh6IojUbj8/keWHdhs5E96A6EcPPmzbGxsby8vJCTj6yNGQemV9PT06mpqRRFyWQy8kI6TU1NXV1d3/rWtyiKeu6552ZmZpqamv7yl79I2uijick3AKsj6jjm3LlzKSkpO3bsePHFF+fn5ymKmp+fNxgMPp9vy5Ytv/vd79iTb731VnR09K9//euEhIS4uLijR4/+5z//IfV89NFH3/zmN6OjoxMTE5977rlPPvkkZHM9PT35+flRUVHBkzdv3vzud78bHR2dkpJy9uxZciKCnOV444034uPjd+3a9Zvf/Ia0tX///m3btsXHxz///PM3btxgljx79iw5zfLCCy/cunXr1VdfjY+P37Fjx49+9KO7d+8KrDVFUXfv3v3JT34SHx//2GOPvfbaa/fu3Qvu/717906dOpWQkLB9+/bnn3/+1q1bfG9cUX/YceCL5BdffPHjH/84Ojo6OTn5F7/4BWlFIBScoIXsOV8oOL1KTEz8+9//TlFUYmLihx9+SOZeuXJFeNdiLxC8Ui+88MKvfvUrZoH9+/eTnc3r9ebk5DDl5eXlFy5c4NQcNuBxcXE//OEPOasTEt9GDxnYGzdufOc734mOjk5LS7t8+bJwzaQ/wR+WkFtnLbsQX0OcDzKne8vLy8ePH09ISEhISPjZz34Wcm8Pu4nhERc+x/h8PqfT2d/fPzAw4PV6a2trKYqKiYkZHR0lh9KlpaXsye9973s+n29gYGBwcHBwcHBoaKi5uZlUVVRUVFZWNjk56XA4cnJyFApFyBYFTpRVVVXJ5fLr16/bbLZLly6xOzk6Ojo8PNzZ2Um+fYaGhioqKqampoaHh5OSkqqqqtir43A4nE6n1+vds2fPzMyMy+W6du2a2+0+ffq0wFpTFFVdXe31eoeGht59992enp62trbg/jc3N9tsNpvNNjY2ptfrR0ZGBN4osj+cOPBFsqGhYWFhweVyvfvuu3a7vb29XTgUnKCF7DlfKEJuLI6ysrJnnnmG5B6Ojz766JlnnikrK2NKglfqyJEjVquVzL1586bT6TSZTD6fT6FQMD9BKIqKiopKTk7m1C8QcJfLRVZncnKSHWE+fFWFDGxVVZVarR4ZGent7WXnmPggTH9CfliCt84ad6GQDXE+yJwVX1hYUKlUw8PD/f39NputtbU1ODgCmxiAoiiKFuR2uymKun37Npns7+83Go3MLJVKxV6STJK3TE5OkvLu7u4nnniCpunZ2VmZTOb3+4NbmZycNBgM5LXP51OpVLOzs8GTgUBAoVCMj48zNcfGxjItMm8Jdv369Z07dzJLzs3NkXKHwxEREbGwsMCs3Ze//GWBtQ4EAiqViulAT09PdnZ2cHM6nW5oaIhdwvdGkf3hxEEgklqt1ufzkddOp3Pfvn3CoeAELbjnAjsAHbSxgvl8vsbGRo1Gc+TIkbGxMVI4NjZ25MgRjUbT2NjI9DbkSi0sLKjVarIvtbW1HTp0iP7fHa+mpkar1Wq1Wnav6HABZ1bH4XDw7c9hq+IggSW7KHvnJ7soTdOeIDT/hyV466xxF+JriLPi7Nd+v//atWtMB6xWK9mdOIEKuYkBGOFzDCeRMJ8ZgRyjUCiY8pGREZ1OR16XlJRkZmaeOHGipaXl6tWrzDKBQMDr9ZLX3d3d3/72t5lZ7Emv1yuXy9k1Mzkm+NthaGjo4MGDer1eq9VqNJqQS7JXhz3JtxinA2NjY+T7mm1ubk4mkwUCAXYh3xtF9ic4LCEjOTs7S1GU9r80Gg2JvJhQ8PVcuIecXvGZnZ01mUwymYxMymQyk8nEfC0Kr1RJSYnFYqFp+uDBg11dXTRNezweZgebm5vzeDzXrl1j94peVcD5cozARg8OrNfr5ez8nI5x8H1Ygjuzxl1I4FPJl2M4RkdHQ7ZIcDYxAGNd/x/zhz/84eLFixkZGYuLiydOnHjllVdIeWRk5K5du8jr+3VHmclkys3NtdvtTqezt7d37Z1fkcjIyPtbIScOISPp9/sjIiIGBwedTqfT6XS5XE6nk1phKFbUczFb59NPP62qqrLb7Q0NDaSkoaHBbre//PLLn376KXvJkCtFTpd9/vnnAwMDpC1yYmdpaYmiqJiYmMTERLlcrlQqxXf7fllRYPnOlW0iy8vLIcuDNzHA/xNOQas7jqFYR+VWq5U5KmdzOp1JSUmcwkAgoNVqmRMCwZMKhcLtdpNJ9rkyzg+r6elp9k8qp9N5X45jxJ8rczqdnPXiO9Ehpj+cOHCwI6lSqTgnu0SGgq/nAj0U7hVRWVmpUqlOnDgxMzPDLp+ZmTGbzSqVqrKyUnil/H6/RqNpbW0tLi5m5ur1evZxcEtLS0FBAfvtqwj4Ss+VhQws51yZ1Wpd0bky5sMS3Jk17kICn0q+4xibzZaZmclU1d3dHfJcGd8mBiBWn2N8Pp9MJmPOwDKTZG8+fPiwx+MZHh7OzMysr6+naXpkZKSgoKCvr29mZmZycvLYsWNFRUVMzeREvN1uT09PZwo5kzRNHz582GQyud3u4eHhjIwM4a/Ltra2ubm5sbExk8l0X3IMTdPHjh07dOjQ5OTk8PBwVlYWOY3D9J9obGzct2+fy+XyeDzk9x3fG0X2hxMHgUhWVlZmZ2cPDw97vd7m5uaGhgaRoeDruUAPg7dOsNLSUuY3QTC3211aWhp2pX7wgx+o1eq3336beaPFYjEajX19fdPT011dXRqNpr+/n1P5SgNOZvn/FzlzyLfRQwbWZDKxd/6w58pCflhCbp217EJ8DdH/+0GenJxkn4fUarV1dXUzMzNDQ0Pp6emkxevXr7ObEN7EAKvPMTRN19fXK5XKzs5O9uTZs2dVKlVTU5NOp4uNjX3ppZfIFcjFxcX6+vrU1FS5XK7T6UpLS6empjit1NTUnD59mqmfM0nT9NTUVFFRkUqlMhgMTU1NAl+Xdrv9iSeeUCgUO3fuPHHixP3KMT6fr6KiQqvVJiUl1dfXk+8gzvKBQODkyZNarVahUJhMJvL7Tswb+frDiYNAJP1+v9lsTkpKUiqVhYWF5GevmFDw9Vygh8FbZy0EVspqtapUKuY6NmGxWAwGg1wuz8rK6uvrC65wpQEn38Ic7e3tfFXRPIH1eDz5+fkqlSo1NbWlpSVsjgn5YQm5ddayC/E1RDAfZL/fr1AomB+Og4ODOTk5KpXKaDQ2NzeTwnfeeScjI0NgpQDYwuSYVRC4bBhWamoq+1YWziTH6Ogoc93y4SYchwdlY/Zqc1nLh0WihqqrqwXu4/D7/QaD4eLFi/eva/CQ21j/8//nP/8pMMnhdDqNRqPEPdoQhOPwoGzMXsEatbS0kFtFQtq6dWtXV9dTTz21nl2CTW1j5ZiwXn/9db1ef+jQofHx8dOnT9fV1T3oHgE8VKKior7xjW8ILIAEAyuyQcf255OXl9fW1paUlFRaWlpdXX306NEH3SMAAOC1habpB90HAAB4OG2y4xgAANhEkGMAAEAqyDEAACAV5BgAAJAKcgwAAEgFOQYAAKSCHAMAAFJBjgEAAKkgxwAAgFSQYwAAQCrIMQAAIBXkGAAAkApyDAAASAU5BgAApIIcAwAAUkGOAQAAqSDHAACAVJBjAABAKsgxAAAgFeQYAACQCnIMAABIBTkGAACkghwDAABSQY4BAACpIMcAAIBUkGMAAEAqyDEAACAV5BgAAJAKcgwAAEjl/wBaflQB3EVPAAAAAABJRU5ErkJggg==)

Screenshot: gramho.com vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	11 June, 2020 14:47 GMT
Vulnerability Verified:	11 June, 2020 14:55 GMT
Website Operator Notified:	11 June, 2020 14:55 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	11 June, 2020 14:55 GMT

JSON