Lucene search

K
openbugbountySQLNinJaOBB:1209950
HistoryJun 28, 2020 - 5:25 p.m.

fumbbl.com Cross Site Scripting vulnerability OBB-1209950

2020-06-2817:25:00
sQLNinJa
www.openbugbounty.org
13

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: fumbbl.com
Open Bug Bounty Program: View Open Bug Bounty Program
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: sQLNinJa
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAARn0lEQVR4nO2dfUxT1/vAr1i10IvyWlHqoI4AEsKYIsOMKYM5HSOGobItY5NN49CgY8wRYc4xdKhsbBkyZowaX5JtMcYYQowzZLoOifJ6xQ5ZRQcVaocFKVatXeV+/zi/78n93bfeFlv84vP5656n557zPM855z695/Y+nUTTNAEAAAAAbsBrvBUAAAAAJiwQYwAAAAB3ATEGAAAAcBcQYwAAAAB3ATEGAAAAcBcQYwAAAAB38eTGGLVaffnyZaHi08NTazgAMLl8+fKGDRtYQlgdTz5PaIy5cuXK6Ojoc889x1t8enhqDQcAFrm5ueHh4UwJrI7/CRzEmN7eXl9fX96PzGbzrl27hIpjpLa2dsWKFbzFjz/+2Nvb+8iRI2PsQsg0Z+VuBRnubNeuqXr37t2PPvooLCzM29s7Kipqz549jx49Ih7HyDrVgif9fOTIkXnz5nl7e8+bN2/v3r2e6ZQXbHVvb6+/v/949S6Cy9PA5QFl9jg4ONjR0VFQUMCswLpKjJ1xWeMTH1qUnp4ekiSlfCRS0wUSExPPnj3LLZpMJi8vL4qi7Hb7GLsQUthZuVtBhjvbtWuqrlq1KjMzs6ura2BgoL6+PiUlpampyeXWXNbHY37ev3+/SqWqq6szmUznz5+PiIgoKyvzQL+8YKt7enr8/Pw8r4DVahWv4PK4PJYTeRthXSXGzris8QmPbLxjHA+3bt3S6XQpKSncosVi8fHxeUrujrHhBoPB3X09ePDg1KlTJpNpxowZBEGkpaWlpaW5u9Pxpays7NChQ0uXLiUIYsmSJcePH09OTi4sLFQoFJ5XRiaTRUZGMg88zLRp0zzf6VhgXSWAJxZJz2O+//57tVodGBj47rvvms1mgiDMZnN4eLjFYpk0adKRI0eYxW+//dbX1/frr7+eOXOmv7//mjVrHjx4gNppbm5+6aWXfH19Q0NDV65cefXqVd7uamtrX3311SlTprCKg4ODzE5ZN7Z4kwHJKysr1Wq1QqF48803BwcHP/300+Dg4MDAwPfff//evXv4rD179nD1FJHz8ujRo+Li4pkzZyoUitWrVw8ODhIEce/evQ8//DA4OHjOnDlffvkl2ndySjeWH7ijgHj48OHatWt9fX3DwsK++OIL1BET1CnviGBGR0cJgpDJ2N85WAMtxef+/v7vvPMO1pDVwg8//LBs2TLcwmeffbZmzRpx94qbKSS/devW66+/7uvrq1arKysrWRtQZrO5r6+PeYV6/vnnz58/j4vNzc2LFi3y9vYODg5evXp1f3+/kNBZOa8wNDS0tbUVHVy6dAmd/uuvv4r7hFmBd3Hxzkw0WLt27QoODp41a9bBgweZO3W8U4U1iEK6CfnB4ThyVeL2yAKvjr///luhULS3txMEMTg46O/vf+7cOSGHSLkEcde+y5MWIKTEGIvFQlFUY2NjU1OTwWDYunUrQRAzZszo6uoiSdJqtebk5DCLb7zxhsViaWpqamlpaWlpaWtrq6ioQE1lZGTk5ubq9fqGhobk5GS5XM7bo9DDmMDAQGanDnVuaGigKMpgMERHR5tMpo6OjosXL/b09JSUlOBqLf+FqaeQXIiKior6+vr6+nqdTjd79uzOzk6CIDZv3mwwGNra2s6cOVNbW1tTU+OUbiw/8I4Coqys7P79+x0dHWfOnNFoNPv27eN1CO+IYBQKRXp6+ltvvXXhwgVmnGMNtLjPOzo6kIZ6vR4bwmohMzNTo9HcvXsX25iVlSXuXnEzheT5+flTp07t7u6ur68/evQoV1u5XI7jN2LhwoX4JqatrW39+vVGo1Gr1apUqvz8fCGhs3Khylxyc3PT0tJQ7GHR3NyclpaWm5uLJbyLi3dmIvO7urq0Wu3hw4eTk5NZnuFOFe404NVNimlC48VSyeHEw6tDrVaXlJSgRzXbt29PT09/+eWXhRzi8BLEu/ZdnrQAQUh4HkMQxMjICCo2NjbOnTsXf8T7PAadotfrkfzkyZMJCQk0TQ8NDclkMt5tX71eHx4ejo4tFgtJkkNDQ7xFkS1avJGNFBgeHkbyhoYGLy+v+/fvYxMiIiJE9BSRC+3VKpXKtrY2psRut5MkeePGDVSsra1NSkqSrhvLcJFRoGk6KCjIYrGgY4qiEhMTuZ7htYjl+ZGRka1bt0ZGRspksoiIiNLSUvTQS7rPsYYNDQ1MDVlnJSUlnThxAstZU0LIz1wzReR2u10ul2P/nzx5kvWQw6md9+7u7pCQEClCZ+VClREWi6W8vDwgICA7O1un0yGhTqfLzs4OCAgoLy/HhgstLu7MpP87WHhN0RIWL83xGK9uvKaxTuQdL65KtOjEY10WbDZbdHR0aWlpUFCQ0WgUcojIJYjpGV7zxSctIILj5zEkSeLtkdmzZw8NDTk8RS6Xz5kzBx1HR0fr9XqCIPz9/VetWpWUlJSamjp79uyEhIQlS5bgZhsbG9Hx2bNnExMT8c4GqygRkiTRcwWCIFQq1fTp0729vXFfJpNJRE8ROS9ms3loaCguLo4pHBgYsNlsarUaN4Kmr3TdWIYLjcKdO3dMJhP+Tefo6Ch3v0vEIqbn0WbFrl27Hj582NbWVlhYaLfbd+zYIWI7E6aGKpVKZJ5kZmbW1dWtXLmyrq4uPT1dypMAITOF5AMDA6Ojo0z/sxqUyWR2u12kx/b29qKios7OTpvNNjo6ivYSeYXOyoUqc1EoFMXFxXl5eR988EFMTMy///5LEERMTExGRsaNGzfwLCIEFhfvzESQJCm0piROfl7dHJomMl1FVOLCWh1Tpkyprq5+5ZVXqqqqZs6cKeQQkUuQQ/NdmLQAwqPvx/z8888HDhyIi4uz2WyFhYWbNm1C8smTJ8+aNQsdi/xq+Ulm8uTJj7dBiYZbrVYvL6+WlhaKoiiK6ujooChKei9Mz2OmTZu2aNGiqqqq48ePO6e0NLKysk6fPk0QRF1dncQ9ByEzXTYffRVFV0ZMa2sr3ifMzMxcvHixRqOhKAppKyR0Vi5UmZfr16/n5+drNJqysjIkKSsr02g0GzduvH79OrOmyOKS4hAX4Orm0LQxTlcMd3UYjUYvLy+j0YglvA4R8pJDXJi0wP8hfpsjtDfC+xHv7fapU6fw/SYTiqJUKhVLaLfbg4KC8BYHq8jqdGRkxMvLi7k/g/dthHSmOds7XD1F5CJ7ZRRFsQwR2iuTohvLcPGzSJJk7YeI75UJjQjewUBoNBq03/VYfM5yXWxsbH19vZ+fH25KpLKQmSJytFfW09ODity9MpqmVSpVfX09Lmq1Wh8fH+SEgYEBmUyGP6Ioys/Pj1coVNnZRnjJy8sjSbKwsNBkMjHlJpOpoKCAJMm8vDzeE/Hi4s5Mms/DUhYv6yyubkKmsU7kHS/eQRfaK+NeFoaHh0NCQn755ZeAgIDOzk4Rh4gLxVeKyKQFRHA9xlgsFplMhrdicRGN06pVq/r6+rRabXx8fGlpKU3TnZ2dy5cv/+2330wmk16vX7duXUZGBm4Z7W9qNJrY2FgsZBW5+iQmJq5bt85oNOp0uuTkZBdiDFdPIfnIyIhMJuvq6kJPKZgbsuXl5YmJiR0dHX19feibHU3T69atW7FihV6v12q18+fPr6qqkq4by3Dxs/Ly8pKSkrRarcFgqKioKCsrY6kqZBHT811dXUqlcv/+/QaDYXh4GClQXl7OHWgXfM5qgabp7du3x8XFMScAy1jr/8dut3PNFDIfydHrPj09PVqtNi4ujnspZ74fo9FoYmJidu7ciT9VKpU1NTXDw8M6nS4zMxOdzit0Vi5UmUtOTg4Ok7yOysnJQcdCi4t3ZjqMMbxThTWIvLrxmsaajbzjxRtjmD3q9Xq5XI7k3MvCxo0bs7OzaZreuXNnSkqKkEPEL0Hi5tOikxYQwfUYQ9N0aWmpj4/P4cOHmcXKykqSJHfv3q1UKv38/N577z30TNtms5WWlkZGRk6dOlWpVObk5KCnc8xetmzZUlJSgttnFbn6dHd3p6amkiQZExNTVVXlbIwhSbKiooKlp5CcpumtW7cie1ld2O32oqKioKAguVyemZmJvtlZLJb169cHBQWpVCre5+ciurEMFz/LarUWFBSoVCofH5/09HT0/Q6rik/njgir5dOnT6ekpEyfPt3HxycuLm7//v28A+2Cz2nOVEE7JLjIBD+4YrJv3z5eM4XMp2naaDRmZGSQJBkeHr57927eS/nhw4ejo6PlcnlkZCT6EoDRaDQJCQlyuTwkJKSwsBDHfq7QWblQ5bEgtLh4Z6Z4jBGaKjRnELkImcacjbzjJXTzinu0Wq1yuRzFG9bqaGlpIUkS3XxYrdbw8PCjR4/yOkTkEsT0A+/ap0UnLSCCgxjjAmN5VzYyMvLixYtCxaeHx2v4E/j2MvrpMOt3RO4D3aV5pq//aZ7AqYLZvHlzamoqPX6XBQ9P2gnDk/We/19//SVSfHqY8IafPXs2OTnZY4m5KIqaO3euZ/oC3MQ333yD7iTGa3V4eNJOGMYh77JarW5tbX377bf/+ecfifUhffdEwmw2V1dXZ2dnu7WXHTt2HDx48Pbt25cuXSopKcnLy3Nrd4C7mTJlysKFC8erd89M2gmJp2MMSse9YMGCqVOnbtmyRWL9pyRB2VMC3ux2ay8pKSk1NTUqlSonJ2fz5s2Q/AMYC56ZtBOSSTRNS6/d29sbHx9/584dl/v76quvjEbj3r1729vb09PTb926JbG+yz0SBNHb2xsbG4tTQQhhNptramqKi4vH0hcAAACA8fR9DH55KiAgwGKxSK8/FsLCwvD78yIMDw+Xl5ePsS8AAAAA49EY42w67seYvhtyPwAAAHgexzGmv79/2bJlvr6+UVFRP/30E5Zz83iLJHhHsJLV88LMGc6qLzF7uUjqcmLM2csBAAAA6TiOMfn5+dOnT+/s7Dx9+jQzxvDm8RZK8I4Q3/jipitn1ZeevVwkdTkxtuzlAAAAgBOIvz6D8j4xk13zvpaM8niLJ3gXydLPm66cVV969nKR1OX408eSvRwAAAAQx8F9zMDAAEEQzGTX+KP29valS5eGhoYGBwcnJiZarVZCNMG7SJb+mJgYm81248aN4uJi/CdRrPo4L/cnn3xSWVn5+++/EwJ59QlHecKdyl7e3d1ts9liYmKEWgMAAACEcP2Zv1MpygnRjTLedOXc+k9C9nIAAABAOg5ijFKpJAji5s2bqKjT6dDB7du3DQbD559//uyzz4aGhgr9azLm0aNHdXV1QjGmuLhYp9Mplcr4+PgNGzaI1F+wYMGaNWuKi4sPHTp06tSpGTNmBAQEOJsFwGq1Mi165plneKtt2LAhPj4+JCREp9PBSzMAAAAu4CDGTJ48efny5YWFhf39/X/++WdpaSmSBwcHBwQE/Pjjj2az+dq1a1guRGNjY0hICP5fQoIg7HY78x8bAwMDv/vuO61Wi16a4da/evXqa6+9du7cucHBwZs3b1ZXV8fHxxMEUVBQsH79+itXrvT392/atOmPP/6QYjbTooyMDCQMCgqyWq3Xrl1DRYvFotVqKysrAwMDpbQJAAAAsHC8V1ZdXT0yMhIdHZ2VlYV+cIU4ceLEoUOHQkJCFi9e7DDhIHfji6Io7g1EWFjYsWPHeOtHREQkJSXl5eWhP0m1Wq0HDhwgCKKoqCglJSU1NTUiIqKvr0/KgxOSJBMSEubPn5+cnBwXF1dUVITkCoVi27Zt8fHx6LfLx44dCwsLc9gaAAAAIIRzuWRcJioq6ujRoy+88AIqPnz4MDo6etu2bWvXrpVS/zEiMa8MAAAAMHY8FGO4XLhw4cUXX/R8vxBjAAAAPMY45PZHjEuAAQAAADzJuMUYAAAAYMIzbntlAAAAwIQH7mMAAAAAdwExBgAAAHAXEGMAAAAAdwExBgAAAHAXEGMAAAAAdwExBgAAAHAXEGMAAAAAdwExBgAAAHAXEGMAAAAAdwExBgAAAHAXEGMAAAAAdwExBgAAAHAXEGMAAAAAdwExBgAAAHAXEGMAAAAAd/EfVtqvG+iLNDUAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAbWklEQVR4nO2df2xUVdrHr3WE/phOoT9GqCMFJYUQghWbpqyFJWJWHCfNWGsh3SqoDTSk1NosppZYa9UCRcxuF6sSTdRsdjdGmwkhpG4mbFLYhpRSxzrUOmAtpQxYp90WpnXolt73j5O979l7zzn33DtzOwM8n79m7px5znOe89x7Zs6d+T53iaIoAAAAAIABxEXbAQAAAOC2BdYYAAAAwChgjQEAAACMAtYYAAAAwChgjQEAAACMAtYYAAAAwChgjQEAAACMAtYYAAAAwChU1piLFy8mJyejxxMTE/v27TPeJS5wx6TH+EHg4sWLCxcunJuOVMOuNXliJNkimFHE6cCHaXT2as0Hrf4Y5P8rr7ySkJDw2WefRdwyIkYy7TZGZY3JysoKBALo8fj4eFNTk/EuaQZ3Eph7eOKvNXliNtkiSywPMxZOq9HR0ZaWltOnT5eVlRnURSxPwe2BSbXF/Pnz58CPMLklnLyNgfjflkR9WoPBYGJi4kMPPRRdN4Bw4N0rm5iYWLp0aTAYvOuuu2TfW8+cObN+/frk5OT77rvvmWee+f7779HxGzduvPTSS8nJyVlZWW+88cbNmzdpB1Evhw4dWrZsWVJS0pYtW0ZHR/fs2ZORkZGWlvbCCy9MTk7yOIlz7ty5tLS0kydPMpyRcebMmXXr1iUkJGRkZDz77LOXL1/GHVu4cOHvf//7iYkJ5RtpxomRuXnz5muvvXbvvfcmJSU9++yzo6Oj7N4PHjx47733Lly4cNu2bb/++iu7x8uXLz/xxBPJyckrVqz461//ygiaIAhff/01PnYeV5FL+/bty8jIWLx48SeffCIo9iqVDiuTB+9aibK9MjiCIFy5cuWpp55KTk5etmzZoUOHlBtBjAAqDb7//vtPPPGE9N69e/du27ZNZnBycnLnzp0ZGRn333//m2++iU+00j3V6SCeU3/605+WLVuWlpb23HPPScmmL3tpDnCebsrtaNUTgeY/LT60SwdidHQUjw8x+MSEpCWG0gLjsgZECt57/ikpKf39/WazORQKyb63OhyO7du3Dw0NnTp1qqCgID4+Hh1vbGycmprq7e1tb2/v6Oj48MMPaQcFQQgGgx6P59SpUx6Px+/3r1y5MhAI9Pb2nj59enBwsK6uTtOoJiYmioqK9u/fv379eoYzMnp6enbs2HH16lWv12uz2SorK5Fjvb29nZ2dXV1dQ0NDRE9oxomRaW5udrvdbrfb5/NlZmb29fWxe+/q6uru7u7u7u7p6Wlubmb3WFlZabFY+vr6jh8/zlhjzpw5s2nTpu3bt0tH+F0NBoP9/f1er/fTTz8tKCiQWSY6rEye7du3b9q06ezZs0T3lO2JwamsrJw3b96FCxfcbvfnn39ONEULoNKg0+ns6Oi4fv06anD06NGioiKZtaqqKr/f39PT097efvTo0dbWVsbcqU6HcpjoLEDJ5vf7a2trUUvd2UtzQMfpxnMi0PynxYd26UCkpaXh8aEFX5mQtMRQWmBc1oCIITIZHBw0m83KxxJjY2MmkykUCinfm56eHgwG0WOPx5OXl0c7ODg4KAjC+Pg4On7q1Km4uLipqSn0tLOzc/ny5TyOSQ/sdvuuXbtUnWFw4cKFRYsWIceuXbsmOfbAAw9wjpQWGavV2tPTw9/70NAQOtjW1pabm8vocWZmJj4+Hm+/YMECmWWfz1dSUpKamtrU1CRZ4HcVuTQ2NiY7KMWf5rAseYLBYFNTU2pqaklJic/nU0aAmGx4cNBgBwYGGINl+KM0KIpifn7+l19+KfUeCoVwN2ZmZsxms9Tj0aNH8/PzGdZ4pkOWxniydXZ2SsmmL3tpDnCebgzfiCcCw39ifBiXDmV8aMFXJiQtMRgWaJkGRAT1+zFsFi5cWFxcnJ+f/9hjj2VmZubm5v72t78VBOHf//53IBBYunQpajY7O2symYgH0WOz2ZySkoIe22w2i8WSkJCAnmZmZmq697h379729vaPP/5YOsLoF+ebb7559dVX+/r6pqenZ2dnZ2dnkWPSjoHNZhsbG5O9i2acGJmJiYmxsbE1a9Zw9h4fH3///fejBitXrhwaGmL0ODIyIggC3l7Zy6pVqxwOx8DAgBRtra6azWbGz5OIDitJSkp67bXXKioqXnzxxVWrVv3nP/+hGaQFZ2RkZHZ2dtmyZYzBMvwhRtvpdB47duyZZ545duyY3W6X3Y0YGRmZnp7Ge0QXOJo1numQgSdbZmYmSjbd2ctwQMfppnoi0PynxYd26SDCCL4sIWmJwbAAGEq4a4wgCH/729/Onj3r9Xr9fn9NTc1vfvObP//5z6FQKC4urru7Wzof4uLiiAfDdwBnamqqra3t73//e2VlZVFRETqROPt1Op3l5eUffvhhfHz88PDw5s2beXpkGFdG5u233xYE4e677w6n93DC2NjY+O677+7atauxsfHBBx+UjmtyNSL8+OOP9fX1HR0djY2Nqo31TY1Wg0VFRWiz5dixY/hG4ty7h2No9s4NNN+Il47ougpEHvbXHNW9Mhkej8dms6HHZrNZuSlEPCizPDg4iO8qyJ4yHBscHDSZTH19faIoOhyOyspKdr84IyMjJpMJH8iCBQvYjvEbF7HIWK1Wj8fD2buAbfW4XC5pq4fYo2xvxOVyEb0NBALV1dVms7miokKrq8QcoO2V4Q7L3lhRUWE2m2tqagKBANEHvD0xOGiwg4OD6CDPXpnkD9Egerx69Wq3271gwQK058OzV0azxjMdjPMLTzZ92UtzgPN04/SNOBa8DSPaOPilQ2mTf6eLlhiwVxYtNKwxwWDQZDLJds/7+vo2b9584sSJQCAwNDRUXl7ucDjQSxUVFfn5+ehDSnNzc2NjI+2gjjXm2rVrJpOpv79/ZmZGeT9GFMX+/v74+Pje3l6GMzKsVmtra+v4+LjP53M6nfxrDNE4LTJNTU15eXm9vb3Dw8OVlZUdHR2M3gVBKC4uHh4e9nq9OTk5DQ0N7OE4nU68PdFbaSxlZWXsSVS6yrPGEB2WJU9ZWZl0FSAia68MjiiKxcXFTqdzcHDQ6/WuWbOGtsYQ/SEaFEWxvr5+zZo1Ug7jaSaKYnl5eWFh4dDQkNfrXbt2bUtLC9ua6nTgw2Qkm77spTkwx2sMzTfGpYNokxh8YkLSEoNogXhZAyKIhjVGFMWGhobExMRPP/1UOjI9Pd3Q0JCdnT1v3jyr1VpWVnb16lX0UigUqq6uttlsiYmJdrsdfYIgHtSxxoiiWFtbi5whrjGiKFZVVW3YsIHhjIyOjo7c3Nz4+PhFixbV1NTwrzFE47TIzMzMvPrqq+np6fHx8U6nU/ogT+t9//79Vqt1wYIFzz//vHRjljac4eHh3/3ud2azOTs7+91332WsMTj8rqquMTSHRVLysMHbK4MjiuLVq1cdDofZbF66dOn+/ftpVz2iP0SDoih6PB5BEHAnpTQTRTEYDO7YsSM9Pd1mszU0NKCFh2GNZzqkYTKSTV/20hyY+zWG6Bvj0kG0SQw+MSFpiUGbPq2ZCWjiLlEUo7JHB6hy8eLF1atXS7+mjX2i6PAPP/ywYcOGn3/+OUx/Jicn09PT/X7/3MjwAEZDTAxgLgFNTOB2wOPxPPDAA+Hb+cc//lFQUAALzG1DpBID0E0EflcGAFHhrbfeyszMLCwsHBgYqKurq6+vD9PgxMTE4cOHt27dGhH3gGgR8cQAwgG+xwC3Khs3bmxtbbXZbOhP4ErpF61It20i4h4QLSKeGEA4qK8xmrSvafreunW/wxcM53FJUy8xOMYwO2U4oEl8Pisray5vxqxfv/7s2bM3btzo7u6empqSvarjZsyNGze++uorthCkpJAfxUIStIob/C5F0PkY1MaXEuP8+fMvv/xytN2501FfY25X7etYkC5nEwse3hKzf0s4GUFiquJG1B0AYpw7eq8s6tLlqsS+h0BUICaGyWTKzs6ee2cAgIHKGiPTvqZpm8s4cOCAUk0dh2iHJnovIZPrRzz99NMHDx5Ej7/99tv58+dLiuI7d+7cs2cPeqyUHGdsF/BIqesbo+ow8TFyiqurStwLdHF1NhEUnyc22LJlyzvvvCO1WbduHepF2ZgxfLY8O7/UPKMLzooJNLdlyvNsQXseaBU37rvvPlzKWrUjYg5rKlQB2viAKiprjEz7miavjRMMBrv/C66mjkO0QxO9Ryjl+hEOh8PtdqPHx44dm52dbW9vR0/dbrfdbhfokuM0VKXUdY+RPUzaGKVOieLqPBL3NHF1NhEUnyc2KCkpcblcqMGVK1c8Ho/T6aQ1pg2fIc+uVWqeEWGeigk0t2XK82xBe02wpenZHdFyWFOhCtDGB9RR/ZemqmSQrLFAUlPn0X0iit4z5PoRfr8/MTERKYTn5eXV1NSUlpaiN1oslunpaZrkOONvzGwp9XDGSBwmbYw84uo8EvcypMIBPEp0kRKfJzaYmpqyWCwokq2trYWFhbTGbG15mvoAzVtlNJTtZREmKuTLOqW5jSvP8wjaq8Izd+yOaDlMHAXbGuh9AWw0/D+GUxxbVd2daIchei+Q5PolFi9enJ2d3dnZuWrVKr/fX19fn52dffPmTbfb/fjjj99zzz0CXXKcCI+Uur4xCoLAGCZjjAiiuDqnxD1RXF0H+sTnaQ0SEhLsdrvL5dq9e3dbWxuSOqY15tGW5/FWoEeDFmGBQ6Kf4Ta+e6lJ0D4cVDvSVDZiztwGbj9i6z+YRCV5olw/jt1ud7vdAwMDDocjJSUlJyeno6ND2ijTyhwUIFAOU3WMYRJd8XlGg5KSksOHD5eVlXV1dbW1tdEaT09PR9BhI6LB7/acCdrr6EhToQrQ4Qe4UP2mE85emaSmzrlXphS9Z8j1S3R2dubl5RUWFh4/flwUxdbW1qqqqkWLFvn9fpEu1cfYcGBLqYczRuIwaWPkESXkkbhXLVvAv1emW3ye1iAUCqWmpv7xj38sKipiNFaVcWQodcreQpOaZ0dYVSGfx20lREF7VTjnjtERLYdFjYUq+B0A7ljU1xhc+5qmbS5BU1Pn0Ugnit4z5PpxrFar1WpF+8XDw8MWiyUnJ0dySXWNkbnHllIPZ4zEYdLGyHl9V5W4F0ni6ri3Ms9psx+O+DyjQWlpqcVi+eKLLxiN2WsMUZ5dq9Q8oz1RIV8ZNFW3RaagPX63Q3qseguEJk3PVs6n5TBxFGxroI0PsFFfY0RM+5omji2Bsr+5uVmppq6qkU4UvWfI9eOUlpYWFxdLT3Nzc+vq6nCXcA+J1xTcPbaUejhjJA6TNkbONUZV4l6kiKvj3uKPZUREfJ7RwOVymc1mvAqAsrGqtrxSnl2r1DyjPU2iXxY0VbdFuqA9ca5pXxFkx4nS9GzlfEYOaypUwXAAABCg7X9bAUrmAADEFHf0//xvP0DJHACAmCK2flcG6ACUzAEAiFlgr+yW5+TJk9XV1V6vd8mSJZWVlSA0CwBA7BC1vTJJEtxQjXR9yuf67PMcN4KIK5nrrnoQWQzqmjg1nH1FpM6FDlM8BiOFai8RKYQB3EFE68cG+G9jwpTW4OzFiB/yc/7y59bC6KDxY0Ri0EbE05emaLAb6wjsnM0FOxQRDAJwJxAT9/xBwR4gMpeJAUkoAaEAIojKGoO+6h48eFCmAU4TLVdKphOl7HFJ8Pfeew//Nk1szyO2r+ydLTzO0DAnyuArtc1p9pXH2TURaEGmOcOvGK8vbuyUwH3Gn0qqXDRJeU7pe2IXNOF9dn4q3aNNGU9fWqcVQSwuoMx/1F1SUtKWLVtGR0f37NmTkZGRlpb2wgsvTE5OEqdAGWdGItEyQXm6yUKnKT1odSuIQSAaN6gaAhBF1L/HBIPBrq4upQa4UrScKJlOlLLHJcGffvppvDtie1XpeGLvbOFxmk2a8LtS25xmX3lctSYCLcgMFXoexXh9cWNlAwc0SXlO6XsaNOF9WuiIcGrRE/vSN63E4gKy/EfNTp065fF4/H7/ypUrA4FAb2/v6dOnBwcHpZHyxJkWDVomsAtqCBrTg2iNUVmDaNzQaghAFGBvpTF07IX/FS2XIUmmExX7RfqfmYntVaXjab3rFvCX2aFpm/Pcj1HVeWMIrdMGJfApxuuLG8/9GNq/4hki8DzS97QuaML7jPyk/WlfVdyM1peoa1ppxQXw/BcEYXx8XOouLi5O+td9Z2fn8uXLlb0T48xIJFomMCpNKFGmhwyiNUYQiMY5cxu4VVD/fwxNx14mWi6QJNPZiv1KiO15xPaJvTM6Ytgk2glH25ynJgItyAwVelXFeCPipgotUJzS9wxo2v6qdRZ0wFNHgGdaOYtKmM1mSWnbZrNZLJaEhATpXYFAQPkWWpw1KfbznJ786UGzxggC0Xi0qiEABhHJ/2DSJNOJiv0MZO05xfY1CbYzbNLsREXbnH9QSvfq6uoiHjceiIGaA8X+Ow1lnP/whz8QW7LPIPbpqTU9NJ3snMahrMCtDftrDo+OPYImmU5U7BeZe2XK9qp64zyC7bKOiDZpdmRI2uZG7JVJQeZUoWe4py9uPHtl165di4uLwzeU2IEiOsP/616GsCkxdAz3ePbKePbZeKaVpx6BajO25wgUZ1o0RHomECtNSL2opocma7LhaDWOj5TRAIg1uH67XFNTc/ny5XPnzjU0NDgcDmKbjIyM1NTUDz74YGJi4vz58w0NDeh4dXX1jh07vvvuu8uXL+/evfvkyZPoeHp6eigUOn/+vMwOsX1ZWdmuXbvOnTt35cqVgwcPvvXWW5y9472kpqaGQqEffvgB/aiGaJNm5/vvv3/yySf/+c9/jo6OXrp06fDhwzk5OYxR4MfvvvvurVu3VldXX7p0CcWwtLSUJ8g0Z5TQ3NMXNzxQsqBJJCcn5+bm1tTU/Pzzz+fPn5du5NI84XFGN8rQ0dwT6FPGg45p5THFCT4XjDgTz1Za8GmnJ0I1PWQesq3J4ExvxkiBWwP2EoQ+Vuzfv1+mAU78uEGUTCcq9iOQJPihQ4dwU8T2qtLxtN7F/xUe5xHwJ9phaJvThM3x4+yaCLQg05zhV4zXHTce2f8LFy489thjZrN51apVLS0tqoHikb5XhkX5WFQUaCCGjugebco4v8eI2qeVZkek5D/je4yIzQUxzoxo0DJBtdKEanrgqFqTDUdpnD+3gVsFFb2yixcvrl69+vr163O25t2BQJB1A6HDgWgAMUhM/M8fAAAAuC2BNQYAAAAwClhjAAAAAKOA+jEAAACAUah/j5nLUiiRgujz119/nZKSIun0CYLw6KOP7t27VxCE69evv/zyy1lZWQkJCStWrDhw4ID0u0zGS4bCU3hDa3EOWVh0zyx/v9EtHzIHqQv1UQBABdVfnt2KFSBoPtvt9qqqKvS4ra0tMzMTiTgVFxc7nc7+/v6RkRG3271x48auri7UjPFSVIagtQ2jve6Z5X9jdJNnDnq/Fc8OAJhLIqklE/u89957a9eura6uXrJkSW1tbVNTU1JS0q+//upyuQKBANKM2rRp06ZNm1B7xksAAACAKip7ZbKaGaoFMzTVm1HWtNiyZcs777wjWVu3bh0q1EGsfsFf50NixYoVO3bsqK2tPXLkiMVi2bZtmyAISImPqBfJeEk2ZNX6H4yCK4L2whs4Bw4c4KkXIguLMkqMINNKvMjQOgpij/xusMuKcA5QoFcx0VHTBQAAGSprjKxmhmrBDEFLvRllTYuSkhKXy4XaX7lyxePxOJ1OYkvJJk+dD5z6+voTJ07U1dW1tLSgI0lJSXa7fevWrf/6179k1w7GS7Ih66j/gaO18Abedfd/YdcLkYVFGSVGkDlLvGgdBbFHfjfYZUX4B0irYhLmnAIAIAha7seoigCKGuvNKGtaTE1NWSwW9PbW1tbCwkJaS8mmap0PJVu3bl2yZAl+5Nq1a7W1tdnZ2SaTafny5bguCOMlfMiq9T/Yohr6Cm9orRfCvh/DCLJs4mjh1ToKYo+cbvCUFdFdMUhfTRcAAJRouB/DUzBD4K43Q6xpkZCQYLfbXS7X7t2729ratm/fTmsp2VSt8yHju+++a29vt9lsH3300c6dO9FBtA+zb9++Gzdu9PT01NTUzMzMIN1AxksSOup/4OgovCGhqV4IA3aQeUq8aB0FsUd+N7SWFdFaMSjMOQUAABG1e/60mhYlJSWHDx8uKyvr6upqa2tjtNRHVVVVTU3Nhg0biouLS0pKZFfP+fPnr1u3rqWlpaysTLaQMF6KCFqr7DDQEbFIBZl/FMQeNbmhqayIjopBAACEj4Y1xmq1zps376effkJfZfr7+6VPhTihUOjSpUvow7XP51uyZAnR2uLFixMTE8fGxh5++GH8uN1uLy8v//zzzx9//HH0+ZfWUgdfffXVwMDA8ePHExISCgoK6uvr0VVpcnIyKSkJH8LMzAx6zHhJE6mpqVNTU9evX0eDGh4ell5KSUlJTU399ttvH3roIa1midHWETFNb8nKylIKL2odBa1HTZ4/8sgjjzzyiCAIdrvd4XAw1hhad7/88ovf73/99dfRU61fUIihAADg/1HdTQsGgyaTyefziaJYXl5eWFg4NDTk9XrXrl3b0tIia4x2z4qLi4eHh71eb05OTkNDg0jZtq6oqMjPz0efQ5ubmxsbG9Hx0tJSi8XyxRdfsFsy7nDgPktMTU0tXbr0L3/5C3rq8/kSExN7e3v7+/utVuuRI0f8fv/4+HhHR8fq1aubmppEUWS8hPfLqc2el5dXXl5+9epVn89XUFCAN2tqasrLy+vt7R0eHq6srOzo6FBVhmdEmxYxWVhkT3mCLEG8EaJ1FMQeOd3o6+vbvHnziRMnAoHA0NBQeXm5w+GQ+cMzQFEUrVZra2vr+Pi4z+dzOp1KhXm23j6UmgcABuprjIjVzGAXzBA11puh1bRwuVxms1m6xUpryV/nA9HY2Ci7zVtdXb1x40ZRFI8fP75x40aLxZKYmLhmzZojR45IbRgv4UOmuYE/ZVQ00Vp4A++6ubmZv16ILCz4U54gE4esexTEHjnd4CwrojpAkaOKib7alAAAiKr1Y7QCFSwAAAAACdBdBgAAAIwC1hgAAADAKGCNAQAAAIwC6scAAAAARgHfYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMApYYwAAAACjgDUGAAAAMIr/A5Hb/AgM4CYsAAAAAElFTkSuQmCC)

Screenshot: fumbbl.com  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 28 June, 2020 17:25 GMT
Vulnerability Verified: 28 June, 2020 17:35 GMT
Website Operator Notified via Bug Bounty: 28 June, 2020 17:35 GMT
Public Report Published
[without any technical details]: 28 June, 2020 17:35 GMT
Vulnerability Fixed: 31 July, 2020 02:34 GMT