pi-consultants.fr Cross Site Scripting vulnerability OBB-1194320

2020-06-1212:39:00

xav0

www.openbugbounty.org

JSON

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	pi-consultants.fr
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	xav0
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAALbElEQVR4nO3cf0gTbxwHcL/b0mUnrHmOpUIrvhlIlNQKIYkQKYqIEWIpItYfUZGyhpRFf4z+sAj7QURFSBRF9UdE9EdIBMUKCQmZZqVzidr8USzTGrVsdd8/Do59n+d+7dYtG+/XXz7b3fN8Pp97zufuNv2H47gMAAAAHRj+dAAAAJC2sMYAAIBesMYAAIBesMYAAIBesMYAAIBesMYAAIBeZsUas2jRou7ubqkmJG+WlHSWhAE66e7u3rt3r8wGP378qK6ufv/+vcoOMWHSwJ9fY16+fPnr168VK1aINiF5s6SksyQM0E99fb3D4ZDZYM6cOZmZmU1NTWp6w4RJDwprzPDwcE5Ojuhb09PTx48fl2qqd//+/a1bt0o11cfzpxAhaa6D5t0PHDgwd+7ca9euSW0glPTTp087d+7My8srKCg4dOjQjx8/EhooyeLLH9nfG4NiGYV+hoeH58+fn2RUiVKTRZITKTXig/z48WNPT4/b7Rbe/f79e3V1NZGp2+1+9OiRms5TOWFAR5ysoaEhhmHUvCWzpbw1a9Y8fPhQqkmLRqMaRtHP76qDtt3D4bDBYPD7/bFYTGoboaRbt26tqakJhUJ9fX1lZWXNzc26xiYVRpLUTADFUIUNhoaGLBZL8lElSjGLJKudGvFBEgFHo9H169dXVlYSWajPK5UTBvTzh5+VjY+PBwKB9evXizZFZWVlpSCwv0UkEsnOzl6xYoXRaBTdQCjpt2/furq6Ll++XFBQsHTp0tOnT9+5cyehsUwmU1FRkbY41RxZlX7LBBBySSapZKT9NJ6YmKioqGhtbdW2+2ybMKCd/BLEX3ScPXvW4XBYrdba2tqpqSmO46ampoQerl69Gt88deoUwzAnT5602WwWi6Wuru7r169S/V+6dKmqqopu8uPSnSheBMVisebmZpvNlp2dXVlZGQ6HOY6LRCK7d+9mWbawsNDr9fKX/HxXra2tDofDYrHU1NTwqXEc19nZWVZWxjBMfn7+tm3bXr9+Td+sCBe/8W8RZeG7Ki0tNZvNLMtWVlaGQiGZcUV3JyKJTzYcDhNlb2lpYVnWbre3tbWJVlhw8+bNdevWKQ4ho729Xf0GRBiig9LHjq9VfFL0hTM9SegyKoaqISOVKQhximaRTAry5wgxExRPgezs7KqqqnA43NTUxLKs1Wqtr6+PRCLqgxQ9N+kXpU5hIsH4CaNrqUFvymtMRkZGfX392NhYMBgsLy/fs2cP/1ZfXx/DMNFolJ+vQnNwcDAjI6OysnJkZCQYDC5btszr9Ur1v3nz5hs3btBNfly6E8U1pqWlxel09vT0hEKhxsZGn8/HcdyuXbu2bNkyMjLS29u7cuXKc+fOCUPU1dWNjY0FAoGysrJ9+/bxndhstra2tsnJycHBwdOnTw8ODqpcY+iyXLp06cqVK1NTUxMTE2632+VyyYxL705HQuRLlL2urm5iYqK9vb2vr0+0wsJe+fn5nZ2dMkOwFKITu91eXl7+4sUL+ih0dnaWl5fb7XbhFSIM0UHpYyfUSkiKWGOkZhpRRplQNWekMgUubqbRWSSTgsw5Qs8EmVOgtrY2FArxU5FlWf5k5+8hGhsb1QepeY2ha8v9f8LoXWrQlao15vPnz3yzo6Nj8eLFwluin0Pwu4yMjPCv37171+l08j+PjIw4HA5hl0gkwjDM5OQk3ZTqRHGNsdlsXV1d8a/EYjGGYYRfnffv3y8tLaVTe/bsGZ/a5OSkyWQinuGqX2NkIgwGg3a7XWpcenfRSAhE2YVi8ogK80Kh0OLFi2/fvi0/RIhCbBCJRFpaWqxWa1VVVSAQ4F8MBAJVVVVWq7WlpYW/CqbDkBqUPnZ0UvQaIzrTiKMgGipNfUbqU5DPIpkUZM4RYjj5U0C4jX727JnBYBCu7js6Ov7991/1QWpYY0Rry/1/wqSg1KCrxD7zV/O7dWhoyGw2C6+/fv3aZrPxP8disbGxMeGtu3fvlpeXizalOokflL7EnpqaMplMxKffY2NjmZmZQjMQCPBXTDKp7dixo6SkxOPxtLa2PnnyRFsdeF1dXRUVFfn5+fzzB4vFItMVvTsdCYF4FEC8S1SYV1payl/GqhxC3uTkpMvlMplMfNNkMrlcLuHXllQY9KCix07+N5TMTBOtBhFqMhmpT0E+i2RSUHOO8DScAvFNlUFqWGOkaktMGL1LDbpK6Wf+RqNxwYIFQjOhby3T/HGIUZKM89atW21tbcuXL5+ZmfF4PA0NDZq7crlc69at8/l8fr//wYMHKY6ELun4+HhPT098P1JD5FHo/t++fbt//36fz3fs2DH+lWPHjvl8vn379r19+1YmDKlBkz92UuhQVW4mmtFsTuEvIlVbYsKkvtTwO8kvQdruYzLi7knv3bsnek8ai8VYlhXu34mmVCdqnpX5/X5iIKkHBTIXcQK/319YWPj582eDwRD/gEvNfcyHDx/ir5r9fn+i9zF0JMSLMvcxREmFF+kPdUSHUHxWtmfPHoZhPB4P/3GrIBwOu91uhmH4j+5EwxAdlD52ivcxUjON2FEqVG0ZJZSCfBbJpKD+HNF2CsTfx6gJUtvnMXRt5SeMHqUGXWm/j2FZNhqNDgwMiDY9Hs/o6OirV6+8Xu+WLVuEvb5//87/0NHRYbfbFy1aJNqU70SG2+3evXv3y5cvR0dHGxoanj59ajQad+zY4Xa73717x3dVU1Mj08ObN282bdr0+PHjjx8/vnv37vz58yUlJTk5OU6n0+PxvH//fmBgoLm5WdjearVGo9H+/v6fP38SdcjLy7NarRcvXpyenh4YGPB6vYrxx+8uGkl8DeWJltRoNObn58sny79VQCH6j0Qivb29p06dys3NjX89Nzf3zJkzvb29kUhENAypQeljpyZN0UlCzEapULVlNKtSUHOOJHoKaAvSYDDEYjHFfmKxmMlkEpp0bYkJk4JSg77klyD5Kx2v15udnc1/t1Jo8l+iPXHiBP0dwfjempqajhw5InRFNPkt6U4U72NisdjBgwdZljWbzS6XS/G7y3RqMzMzXq+3qKgoMzPTZrPV1tZOTExwHMd/rY5hmOLi4nPnzsXXobm5ma4D3/T5fE6n02w22+12j8ejeB8Tv7toJDK3j0RliJKKDieV7G9EhyE1KH3sFO9jpGYaR03O30t9CpzSxbXmFBI6RxI6BYimyiCj0ajZbCa+UkEHc+fOneXLl8vUlpgwqSk16EdhjdFAcRngFRUVPX/+XKqpshOQQZQ0/cJIg0mSTAopS1/9QI2NjfR3TOJFo1GHwyH88ZYonSZMGsyWv5RJ+U5HH/39/TJNSN4sKeksCQNSoLW1lfgCDiErK+vGjRtr166V2QYTJs38+f+7DADpYc6cOatXr5bfRn6BgfSDNQYAAPTyD8dx8ltMT09fuHDh8OHDqQkIAADShvIaMzw8vGzZsi9fvqQmIAAASBt4VgYAAHpRuI+Znp62WCz8z1evXrXb7Rs3bkxJYAAA8NdTflbW39/vdDrD4bDJZCosLCwuLj558uSqVatSEx8AAPy9lJ+Vmc3mjIyMrKwso9EYDAYrKio2bNiwfft24b9cAAAAiErs85h58+YdPnw4GAzOzMwUFxfrFBMAAKSHhD/zT79/MA4AADpJbI3Zu3dvSUmJ3W4PBAL4ixkAAJCn/P/KhH/fvWTJEv4fjC9cuDAFkQEAwN9OeY2ZN2/e0aNHS0pKLly4cP369RTEBAAA6UH5u8sAAADa4O/8AQBAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL1hjAABAL/8B7+WQaF+0zHsAAAAASUVORK5CYII=)

Screenshot: pi-consultants.fr vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	12 June, 2020 12:39 GMT
Vulnerability Verified:	12 June, 2020 12:51 GMT
Website Operator Notified:	12 June, 2020 12:51 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	12 June, 2020 12:51 GMT

JSON