market.us Cross Site Scripting vulnerability OBB-1211921

2020-06-3019:44:00

raviakp1004

www.openbugbounty.org

JSON

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	market.us
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	raviakp1004
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAALzElEQVR4nO2cf0xT1xfAn6zUUl4RSotYalbIgo4YZwhDzJgzTVRCGkImgtvQISMbI0oawtzUZWMkw2WiQTSGGCSbIWoWQxr+WJxxZOmULMyM0rHKmtp0XekYqVBI7d5q1/f94+Z783y/WrFFbM7nr3du7z33nHMP7/Td+8oqmqYJAAAAAEgAKU/bAAAAACBpgRoDAAAAJAqoMQAAAECigBoDAAAAJAqoMQAAAECigBoDAAAAJIqVW2Py8/MnJiaExKQhWf0CMBMTE++//75Ih4cPH77xxht///33spkEAMvGCq0xv/76ayQSeemll3jFpCFZ/QKYNDQ06HQ6kQ6pqalSqbS9vX25LAKA5SNKjfnjjz8UCgXvRwsLCydOnBASn5Dh4eGqqiohMV6IeCdEgtycn58/ePCgWq3Oy8v78MMPHz58GK8pYufs2bP5+fnp6elbt279/vvv46JzCRGORWdWVlZ8dcYXZpLcv3/farUajUYkzs/P79+/Pzs7m7XQRqPx5s2bT8dcAEgkS3+O8fv9XV1dQuITsjw1ZgkkyM2GhoZQKGSxWEZGRkZHRz/55JN4TREjZ8+e7enpGRgYcLvdR44c2bdv3+3bt5fZhqSBmSSBQEAul69evRqJjY2NkUjEarXevHnTbDbjbkqlMhAIPB1zASCh0KK4XC6SJGP5SKTn4+L1ejMzM0OhEK8YR5ZgcyLcDAaDWq02EAig9rGxsRdeeCEuU8SORqMZGRnBYl9fn8FgeHK1cQwXU2dmZmZ8dcYXptfMa4qiJBKJ3+9H4q1bt4qKirjdACCZiOk55syZM/n5+dnZ2fv3719YWCAIYmFhQafTBQKBVatWff3110zx9OnTCoXi5MmTa9euzcrKevvtt//55x+k5+eff3711VcVCkVeXt6ePXvu3r3LO93w8PCuXbtSU1NZItp4OXXqFNrSqauru3///gcffKBWq7Ozsw8ePPjgwQM80bZt29LS0tRq9d69e6enp4n/79ucOHFCrVavW7fu4sWLzEl/++237OzsH3/8EYn//vvvO++8o1Aonn/++U8//fS///7jeo3HsnaEWJs5Ql5jv9LS0v7888/09HTU7nA4NBpN7OHi8t1334lMXVdX9/nnn+PO27Zt6+vr83q95eXluLGxsfHcuXNczQ8ePHjvvffUavX69es/++wzFBbmumRlZb311lsoScThVUUIrN309PTu3bsVCsWGDRsuX74srhnZw81A3gTgmhFjmgnNIpQkBEFQFBWJRKRSKRJlMlkwGOR1Aa8gADzziJcgl8tFEERDQ4PX63U4HHq9vrm5GX00NTVFkiRFUeFwmCk6nU6CIGpqatxut8Ph2LRpU0dHBxqSk5PT398/NzfndDpPnz7tdDp5J62srBwcHOSKyJj6+nqPx2O328vLy1UqFbLNbrfv2LGjtbUVDenr6xsYGPD7/TMzM0ajsbq6Gg8/cODAzMzM9evXp6am8JdHv99fWFh44cIFPOmxY8f27dvndDptNtuOHTvOnTvH6zWOEuuRjvlFW8hrlptYv0ajGRsbExmo4oCHj42N6fX63NxckamvXbtWUlKCOni9XplMdvfuXZlMxrsWLBobGw0Gg9vtnpycLC4u7u3tZQYWLUR5eXlLSwtvZKKqogXWrrq6mplROLy8oUD2cDOQmwC8ZsSYZkKz0I8mCSsCJSUlRqMxFAotLi4aDIaamhreQOXm5ur1+jt37sSyKACwkompxiwuLiJxdHS0oKAAf8S7V4aGuN1u1D40NITuaHNzcxKJhKIo7ixut1un06HrQCBAkuTc3BxXRJqZWw0pKSnBYBDbxrvF5HA40D0XDceamTZXVlbi2yJCpVLhzSuLxVJaWsrrtVAo8E1QyGuWmwiPx1NQUHD16lXxcHk40DRtt9tra2uVSmVXVxeyXEhDMBjMyMhAC3T+/Pmqqiqm/e3t7ehmjRcaEw6HSZLEpW54eLisrIzmJMmtW7eEkiSqKhZo7cLhsEwmY2YUDi9vKIQykJsAvGbEmGZCs9DCe2U0Tdtsti1btkilUrlcThDEjRs3eLsFAoGuri6lUllbW2u327mRAYBnBUnUBx2SJPFGkEajmZubizpEJpOtX78eXW/cuNHtdhMEkZWVVVNTU1ZWptfrNRpNSUnJa6+9htWOjo6i6xs3bpSWluK9JpZIkuSaNWvQtVarzcjISEtLw0p8Ph+6Hh8fP3LkiM1mC4VCkUgkEong4dxXko4fP379+vX+/n7cMj8/7/P58PumkUhEIokeKF6EvGb5haipqTEajXV1deLhysvL405UVFRkMBicTieOj5CGtLS0yspKk8l0+PDhoaGhhoYGiUQSDofRqI8//thoNHo8noqKCtYUs7OzoVAoPz8fiRs3bkT3WeLRJNFqtVGTREQVd+1mZ2cJgmBmFNbDGwpCIAMJTgIImRFjmgnNIsKLL744Pj6+sLAwMDBw+fLlnTt38nZLT08/evRoc3NzY2NjUVHRU3nPEADiwrL+PubKlSv9/f2bN28OhUJtbW2HDx9G7c8999y6devQdVzeKKuurt6+fbvZbLZYLN9++61Iz2AwODQ0dPXq1Y8++gifIlAUlZKScufOHYvFYrFYrFarxWJ5XBswvF5z/frrr7+sViuOidBAgiDUHAiC6OzsNJvNLS0t9+7di6qhtrbWZDLNz8+PjY1VVVWhjR10I1uzZk1eXh7+or38xL52hEAoVj5yubynp0f87cF79+4dOnTIbDZ3dnYum2EAEH/EH3NEdoFi3CszmUx4D4GJxWLRarWsxnA4rFKp8N4FSxQ/9sDi7OysRCJhToTaufs2LpdLIpHYbDaapg0Gw6FDh/BHJEn+8ssvUQOCWFxcTElJYW4WCb34hLxm+YWdFTqgoh8NF+8GEU3TPp/PaDSSJInPzIQ0UBSlVCp7enpef/111KLRaH744Qfcubu7u6KigqVBZK8sxiSJqop37Vh7ZSaT6bH2ynAGco0R2iuLJc1E8lxkrwxx4cKF4uJiZgurW3NzM0mSbW1tPp+PGz0AeIZYeo0JBAISiQRvFmMRn4V6PJ7JycktW7ags1CbzVZRUTEyMuLz+dxud1NTE/PtWHRsYDabN23ahBtZYox//DRN5+TknD9/3u/32+326upqkRqDW6ampmQymdVqRWJzc3NZWdnk5KTX6/3yyy87Ozt5vcanHaWlpU1NTTMzM+iUGFvC6zXLL1YQRAZyh3BxuVz19fVRNbz55psZGRnffPMNEnt7ewsKCkZGRmZnZwcHB5VK5ejoKFd5U1NTVVUV98xfvMZQj4Jel+BVRQusHTrzxxkl/u6yUAby3u65ZjxWjeHOQj+aJG63m/U+RTgcLigoGB4eZjY6HA7mLPX19S6XS8RHAHhWWHqNoWm6o6NDLpd/9dVXTPHUqVMkSX7xxRc5OTmZmZkHDhxA56WhUKijo6OwsFAqlebk5NTX18/MzLBmaW9vP3bsGNbPEmOvMWazuaSkRCaT5ebmtrW1xVJjaJpubW3dvn07uqYoymg0arVauVxeWVnJfMLAXjOHo5fuSJIsKirq7e3FlvB6zfKL1x2RcMWIuAaTyUSSJD7Kpmm6t7dXp9NJpdLi4mLmb2WYBAKBd999V6VSabXajo4OVC3Eawz30bmvr09IFS2wdh6PZ9euXSRJFhYWdnd3R60xvBnIW2O4ZsReY3hnQeAkoShKJpMxz+0vXbrEeoihafratWubN28WcQoAnlGi1Jgl8CS/JissLPzpp5+ExKQhWf1aISzP7xljn6W1tVWv14t0oChKp9P19/fHyTQAWEEs8XWpBPH777+LiElDsvoF8NLd3S3+zsjq1asHBwdfeeWVZTMJAJaNFfp/lwEgaUhNTX355ZfF+0CBAZIVqDEAAABAolhF0/TTtgEAAABITuA5BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARPE/fyhSr/X7vQIAAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAALzElEQVR4nO2cf0xT1xfAn6zUUl4RSotYalbIgo4YZwhDzJgzTVRCGkImgtvQISMbI0oawtzUZWMkw2WiQTSGGCSbIWoWQxr+WJxxZOmULMyM0rHKmtp0XekYqVBI7d5q1/f94+Z783y/WrFFbM7nr3du7z33nHMP7/Td+8oqmqYJAAAAAEgAKU/bAAAAACBpgRoDAAAAJAqoMQAAAECigBoDAAAAJAqoMQAAAECigBoDAAAAJIqVW2Py8/MnJiaExKQhWf0CMBMTE++//75Ih4cPH77xxht///33spkEAMvGCq0xv/76ayQSeemll3jFpCFZ/QKYNDQ06HQ6kQ6pqalSqbS9vX25LAKA5SNKjfnjjz8UCgXvRwsLCydOnBASn5Dh4eGqqiohMV6IeCdEgtycn58/ePCgWq3Oy8v78MMPHz58GK8pYufs2bP5+fnp6elbt279/vvv46JzCRGORWdWVlZ8dcYXZpLcv3/farUajUYkzs/P79+/Pzs7m7XQRqPx5s2bT8dcAEgkS3+O8fv9XV1dQuITsjw1ZgkkyM2GhoZQKGSxWEZGRkZHRz/55JN4TREjZ8+e7enpGRgYcLvdR44c2bdv3+3bt5fZhqSBmSSBQEAul69evRqJjY2NkUjEarXevHnTbDbjbkqlMhAIPB1zASCh0KK4XC6SJGP5SKTn4+L1ejMzM0OhEK8YR5ZgcyLcDAaDWq02EAig9rGxsRdeeCEuU8SORqMZGRnBYl9fn8FgeHK1cQwXU2dmZmZ8dcYXptfMa4qiJBKJ3+9H4q1bt4qKirjdACCZiOk55syZM/n5+dnZ2fv3719YWCAIYmFhQafTBQKBVatWff3110zx9OnTCoXi5MmTa9euzcrKevvtt//55x+k5+eff3711VcVCkVeXt6ePXvu3r3LO93w8PCuXbtSU1NZItp4OXXqFNrSqauru3///gcffKBWq7Ozsw8ePPjgwQM80bZt29LS0tRq9d69e6enp4n/79ucOHFCrVavW7fu4sWLzEl/++237OzsH3/8EYn//vvvO++8o1Aonn/++U8//fS///7jeo3HsnaEWJs5Ql5jv9LS0v7888/09HTU7nA4NBpN7OHi8t1334lMXVdX9/nnn+PO27Zt6+vr83q95eXluLGxsfHcuXNczQ8ePHjvvffUavX69es/++wzFBbmumRlZb311lsoScThVUUIrN309PTu3bsVCsWGDRsuX74srhnZw81A3gTgmhFjmgnNIpQkBEFQFBWJRKRSKRJlMlkwGOR1Aa8gADzziJcgl8tFEERDQ4PX63U4HHq9vrm5GX00NTVFkiRFUeFwmCk6nU6CIGpqatxut8Ph2LRpU0dHBxqSk5PT398/NzfndDpPnz7tdDp5J62srBwcHOSKyJj6+nqPx2O328vLy1UqFbLNbrfv2LGjtbUVDenr6xsYGPD7/TMzM0ajsbq6Gg8/cODAzMzM9evXp6am8JdHv99fWFh44cIFPOmxY8f27dvndDptNtuOHTvOnTvH6zWOEuuRjvlFW8hrlptYv0ajGRsbExmo4oCHj42N6fX63NxckamvXbtWUlKCOni9XplMdvfuXZlMxrsWLBobGw0Gg9vtnpycLC4u7u3tZQYWLUR5eXlLSwtvZKKqogXWrrq6mplROLy8oUD2cDOQmwC8ZsSYZkKz0I8mCSsCJSUlRqMxFAotLi4aDIaamhreQOXm5ur1+jt37sSyKACwkompxiwuLiJxdHS0oKAAf8S7V4aGuN1u1D40NITuaHNzcxKJhKIo7ixut1un06HrQCBAkuTc3BxXRJqZWw0pKSnBYBDbxrvF5HA40D0XDceamTZXVlbi2yJCpVLhzSuLxVJaWsrrtVAo8E1QyGuWmwiPx1NQUHD16lXxcHk40DRtt9tra2uVSmVXVxeyXEhDMBjMyMhAC3T+/Pmqqiqm/e3t7ehmjRcaEw6HSZLEpW54eLisrIzmJMmtW7eEkiSqKhZo7cLhsEwmY2YUDi9vKIQykJsAvGbEmGZCs9DCe2U0Tdtsti1btkilUrlcThDEjRs3eLsFAoGuri6lUllbW2u327mRAYBnBUnUBx2SJPFGkEajmZubizpEJpOtX78eXW/cuNHtdhMEkZWVVVNTU1ZWptfrNRpNSUnJa6+9htWOjo6i6xs3bpSWluK9JpZIkuSaNWvQtVarzcjISEtLw0p8Ph+6Hh8fP3LkiM1mC4VCkUgkEong4dxXko4fP379+vX+/n7cMj8/7/P58PumkUhEIokeKF6EvGb5haipqTEajXV1deLhysvL405UVFRkMBicTieOj5CGtLS0yspKk8l0+PDhoaGhhoYGiUQSDofRqI8//thoNHo8noqKCtYUs7OzoVAoPz8fiRs3bkT3WeLRJNFqtVGTREQVd+1mZ2cJgmBmFNbDGwpCIAMJTgIImRFjmgnNIsKLL744Pj6+sLAwMDBw+fLlnTt38nZLT08/evRoc3NzY2NjUVHRU3nPEADiwrL+PubKlSv9/f2bN28OhUJtbW2HDx9G7c8999y6devQdVzeKKuurt6+fbvZbLZYLN9++61Iz2AwODQ0dPXq1Y8++gifIlAUlZKScufOHYvFYrFYrFarxWJ5XBswvF5z/frrr7+sViuOidBAgiDUHAiC6OzsNJvNLS0t9+7di6qhtrbWZDLNz8+PjY1VVVWhjR10I1uzZk1eXh7+or38xL52hEAoVj5yubynp0f87cF79+4dOnTIbDZ3dnYum2EAEH/EH3NEdoFi3CszmUx4D4GJxWLRarWsxnA4rFKp8N4FSxQ/9sDi7OysRCJhToTaufs2LpdLIpHYbDaapg0Gw6FDh/BHJEn+8ssvUQOCWFxcTElJYW4WCb34hLxm+YWdFTqgoh8NF+8GEU3TPp/PaDSSJInPzIQ0UBSlVCp7enpef/111KLRaH744Qfcubu7u6KigqVBZK8sxiSJqop37Vh7ZSaT6bH2ynAGco0R2iuLJc1E8lxkrwxx4cKF4uJiZgurW3NzM0mSbW1tPp+PGz0AeIZYeo0JBAISiQRvFmMRn4V6PJ7JycktW7ags1CbzVZRUTEyMuLz+dxud1NTE/PtWHRsYDabN23ahBtZYox//DRN5+TknD9/3u/32+326upqkRqDW6ampmQymdVqRWJzc3NZWdnk5KTX6/3yyy87Ozt5vcanHaWlpU1NTTMzM+iUGFvC6zXLL1YQRAZyh3BxuVz19fVRNbz55psZGRnffPMNEnt7ewsKCkZGRmZnZwcHB5VK5ejoKFd5U1NTVVUV98xfvMZQj4Jel+BVRQusHTrzxxkl/u6yUAby3u65ZjxWjeHOQj+aJG63m/U+RTgcLigoGB4eZjY6HA7mLPX19S6XS8RHAHhWWHqNoWm6o6NDLpd/9dVXTPHUqVMkSX7xxRc5OTmZmZkHDhxA56WhUKijo6OwsFAqlebk5NTX18/MzLBmaW9vP3bsGNbPEmOvMWazuaSkRCaT5ebmtrW1xVJjaJpubW3dvn07uqYoymg0arVauVxeWVnJfMLAXjOHo5fuSJIsKirq7e3FlvB6zfKL1x2RcMWIuAaTyUSSJD7Kpmm6t7dXp9NJpdLi4mLmb2WYBAKBd999V6VSabXajo4OVC3Eawz30bmvr09IFS2wdh6PZ9euXSRJFhYWdnd3R60xvBnIW2O4ZsReY3hnQeAkoShKJpMxz+0vXbrEeoihafratWubN28WcQoAnlGi1Jgl8CS/JissLPzpp5+ExKQhWf1aISzP7xljn6W1tVWv14t0oChKp9P19/fHyTQAWEEs8XWpBPH777+LiElDsvoF8NLd3S3+zsjq1asHBwdfeeWVZTMJAJaNFfp/lwEgaUhNTX355ZfF+0CBAZIVqDEAAABAolhF0/TTtgEAAABITuA5BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARAE1BgAAAEgUUGMAAACARPE/fyhSr/X7vQIAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAXd0lEQVR4nO2df0wT5x/Hz8qgYIuCbeVH/QrOoWOMMSQEF+aI2Q/WNaTizzE2XUZwMcgImUTRMaabMsVlc4y5xS3OLJsxyogxhCydM4wQxxi7If5C4wBrQUS0iqxUaL9/PNmTW++55+5KD9B9Xn+1T597Pj+e5+7pPde+nykej4cBAAAAAAVQTbQDAAAAwAMLzDEAAACAUsAcAwAAACgFzDEAAACAUsAcAwAAACgFzDEAAACAUsAcAwAAACgFzDEAAACAUkyKOcbhcOzcuRO97urq0mq1fmzc7w1KtNLV1RUWFoZfT+Ewe/bszZs337t3b3w85Hrid7h9x7U4DjkXYmKtjyeK9qxvEMcD8F9mUswxt27d2rFjx0R7oSwajcbpdDqdzqGhobq6upMnT27btm2infIDxL6bM2dOf3//hPgDTCz/hXMZkMWkmGP+IwQFBQUFBQUHBz/++OOVlZVHjhyZaI8UJCgoaKJdAABg4hGfY0ZHRzdv3jxr1qxp06atWLHixo0bDMPcvXt33bp1er1+9uzZ77333ujoKPPPGsXu3btnzZoVFha2Zs2av//+m2GYzz777IUXXsANbtmyZc2aNfitw+GIiYkZHBycMmXKN998gwo/+eST2NjYmTNnvvrqqw6HAxUODw+/8cYbWq12zpw57777LjLK5bffflu0aFFwcLBer1+xYsXVq1fxRx9++KGXV8QoVq1a9cEHH+CjFi1ahFwSNS0XtVrtdDql1yeGhhK+Z8+e2NjYsLCwV155Befq6tWrL7zwglarnT9//nfffcdvUKizhGz99ttvTz/9tFarjY6OXrZs2blz5xiBvmM4q1UUD32Ojj6cMPweRw3u3LlTr9dHRkZ+9dVXDGkMLF26dPfu3aiRP//8MygoCPu8bt26jRs3CmWDOEiIRumx05NG71mh5PDD9FpRFFp26+npeemll7RabWxs7J49e3AdYrD08UAcbLKuJHwoUUhvBFAU8Tlm165dVqvVarV2dHRERUWdPXuWYZjCwkK73d7a2lpfX3/s2LHq6mpUeXBwsLm5uaWlpaWlpbW1ddeuXQzDWCyWhoaGO3fuoDrHjh3Lzs7G7U+fPv38+fNoKSk3Nxc1wrJsU1NTc3Oz3W7ftGkTqrlt27ahoaG2trb6+vqGhoZ9+/Z5udra2pqfn9/b29ve3m40GgsKCrBXLf+AvSJGsXLlytraWvRpT08Py7IWi0WKaVk4HI7y8nKTyST9EEpobW1tKFfd3d2lpaWovKCgIDQ09OzZs3V1dcQ5hhHoLCFbZrN57dq13d3djY2N6enparWaIfUd0QrRQ5+jow8nfCCxxwcHB8+fP9/e3n7gwIH09HSGNAbMZrPVakX1jx8/7na76+vr0Vur1Yp6jZgNoUHCNyoaOyVp9J4VSo7QCStKQUFBYGDgpUuXrFbrwYMHcTkxWMp4EBpssq4kcvFLI8BY8YhhMBhaW1u5JSMjIxqN5vLly+jtsWPH0tLSPB5PZ2cnwzDd3d2ovKamJiUlBb1OS0s7cuQIqoOGILdBVIhfMwxz+/Zt9LapqWnu3LnotU6nGxwcRK9Zlk1NTaW4fenSpYiICIpXxCiGhoZCQ0NR5erq6qysLImmuSHgkhkzZnCD0v1DYGBgTk4ObpB/LB2v0HCuGhsbUa5GRkbUajU3ZOwJ1z2hzuLbGhgYCAgI8Oo1ivO4UMjDsUTnkTCciKGh8oGBAVyTOAbsdntISAhqMzU1tbi4OCcnBx0eGhrqcrmEskEcJHyjorFTApfSs/zkEMP06jjucOXmR61W4wO55oTOCKHxIP0cpNTnQ4lCeiOAogTQZyCHwzEwMJCYmMgt7Ovrc7lcsbGx6O2CBQtQdzIMo1arZ8+ejcu7u7vRa4vFcvz48WXLlh0/ftxkMtEX6zUaDb7/jYqKGhgYYBjm5s2b/f39MTExqNztdgcEeDv/xx9/lJSUnD171uVyud1ut9tN8YoYRXBwsMlkqq2t3bBhQ01Nzdq1ayWaFiUkJIRlWYZhrFbrpk2b9u/fHxwcLP1wodC4uTIajShXfX19DMNwQya2KdRZfFthYWHLly9PS0tbsmRJVFRUSkrKM888I9FzoodjiY6RMJyEQtNoNNwVIeIYiIyMjIuLa2pqio+Pt9vtZWVlcXFxo6OjVqv12Weffeihh4jZoAwSL6NSYhcKXErP8pPT09MjdMLS6evrc7vd3APRCx/OCOnnIKU+wzB6vR63ef36dR+MAuOMpGvl1KlTx2gmOzsbrRIcP34cXbjl4nQ6VSpVS0sLHs0qlfdCn8ViycvL27dvn1qtttlsmZmZPhhauXJlVVVVbm5uc3NzTU2NRNPom+/o6CjO1eDgYEhICK6gUqmio6MZhlmzZk1lZeX+/fs3bNgg3Su/hDYWW99///3vv//e3t5ut9uLi4ufeuqpTz/9VFGLFMY+nOiYTCar1Xr58mWz2Tx9+vSkpKSGhga8UMaQslFaWio6SIj4vWeVTg4j7YxQCPRFDbifEL3TMRgMLMtySyTe4dbW1nJvThMSEqxW64wZM/AiAMZrrUzo5lej0Xit2nHp6+sLCAjAb1mWRQcKeSUUhdPpDA8P//jjj7Ozs3FrdNMIg8HQ2NiI31ZXV2dmZhKDOnTokNFoxIstomtllNCIufJaUamtrRVdK8NpEbLFhWVZo9FIcZ67Via6ICM3OgR9OBFD47sqNAaamppSU1OzsrLq6uo8Hk91dXVhYWFERITdbvfwwNkgDhJ65xJjpwQupWf5ySGGefv2bZVKxV2RE1or6+zsRG+5a2VCZ4SUtTLRc5B+JeFCiUJ6I4CiiM8xO3bsSE1NbWtrs9lsBQUFDQ0NHo8nLy8vKyuru7u7vb09OTl57969nn86dfny5Tabrb29PSkpqby8HLdTVlaWmJhoNpv5JgYHBwMCAjo6OjzUK8ubb76ZlpaGvjzu2rVr27ZtXu0YDIbq6upbt251dHRYLBbuHEP0ihiFx+PJyckJDQ09fPgwblnUtMfjqaqqiouLa2ho6O/vP3LkSHh4OJ5y+CdefHz8vn37uJ86/83IyIiU0IRyZbFYuCELzTHEtPBtnT17NjMz88SJE/39/d3d3Xl5ebgfuX3HbVz6HONDdB7qcBIKjXj5ExoDBoPBYDCg7wE2my00NDQpKQl9JJQN4iAR/QLBj50euGjPEpNDDDM1NTUvL6+3t7ejoyM9PZ3Y1PLlyy0WS2dnZ3t7e2JioujJKDQeZJ2D9CuJF0JRUBohPlkEFEJ8jhkZGSkpKdHpdGq12mKx9Pf3ezyewcHB/Px8nU5nNBrLy8vRBRGdGxUVFQaDYcaMGa+99trQ0BBuB93kHjhwgGilvLw8JCTkwIEDlBPM6XQWFRUZjcaQkBCTyYS//mAaGhpSUlLUanVERERxcTH3UrVr1y6+V8QoPB5PbW2tRqPhOi9qGvHRRx/FxMQEBgYmJCTU1NRwo/C60Hz77bcxMTEul8vzz8ngBZ6BREMj5spmsz3//PMajSYuLq6yspI4xwh1Ft+Wy+UqLy+Pi4sLDAw0GAy5ubm9vb38vuPHK3GOkRudhzqchHqceLkXGgM5OTnLly/H1VJSUkpLS9FroWwQB4noHMOPnR64aM8Sk0MM89KlS0uWLNFoNPHx8Xv37iU21dvbazabNRpNTExMRUWFlJNRaDwQB5sPVxIvhKIQakTuT2yAMTLF4/H4a9mtq6srISEB/27Si7t37+p0OrvdPtnUL/6b0Dtr8gPDiYJCyblw4cLixYuvXbsm90C5g80vg/N+H+EPDOP3P/8ff/wxPT0drgiAX4DhREGh5LAsO3fuXP+2CTzwyP4Nrm84HI6qqqrVq1ePjzngwQaGEwX/Jmf79u1RUVFZWVmXL18uLS0tKyvzS7PAf4dxuo/BS6LjYw54sIHhRMG/ycnIyKiurjYajbm5uYWFhUTZHgCgIfrEBgmpesbrWdn98kQuMzOzoqKCW1JfXx8VFSVUf2KzR3kIj9/ijh4HKL9WF60vpVxRxpKo8UyyXLi+TaqECzkw4c4AUhC/jxlnse77RRY+OzsbK5shamtrkbjZJEQoq9zy8ezo+6WXiYwlUZNZ+l6KbxPecRPuACCXyajtf1/IwmdlZbW0tHB/Y0MUZ5w8CGV1orJ9X/QywGfCO27CHQBkITLHcMW6jx49ygio7jMkrW+iqrmoSD5XrJuooO5VE0mgT5s2bdWqVTdu3Ni4caNer585c+brr79+9+5dVJOiHy7XPcysWbPS0tLwrcyvv/7qdDozMjKkSKZTxNul68PL2shAaGtIXO6lyi6qn0+0TtwZgaLbT0ys3A0auIh2n9yNKvh9xJevF3KYb4sufS9lJEuJUUjGn77DgsQtNrw6jn6GEr2VFazQxgf8rgcmLSJzDFese+nSpUKq+4yA1jdf1VyWSD5RQZ0L8qexsZFlWbvdvmDBgv7+/ra2tlOnTnV2dmJFdIp++Fjc4y6X1dbWms1m6cJuQuLt0vXh5W5kQMdLlV1UP59onbgzgpCfQowlLtHuk7tRBb+P+PL1Qg7zbdGl76WMZCkxEsMR3WFB+hYbXETPUKHLgsRg5Q4eYDIi+sRGSKedq7rvIWl9E1XNpYvkU/TkcU2GYW7duoXeNjY2qlQq/H/gpqamefPmecQ0keS65+WAWq1GCVmwYEFtba1H+N/pXs8qGQHxdt/04UU3MpDyzN/rI7p+PtG60M4IRD+lPLmVHhcle1zkblRB7CMpDhNtCR0rcSRLiVFIxl8oFiHfhE52bh3RM5ToraxgueCND4RGTnd3d0xMDMUZYEKQ9/8Youo+I6z17aVqLksSXIqevEajmT59OnptNBpDQ0OxYH5UVBR6NkjRDx+LewzDzJkzZ8GCBXV1dUlJSUjhg1KZ7zlfvF2WPrysjQx8gK6fT7RO3BlByE8hfI5LtPvkblQhZVcCIYeJtihIGclSYhQKR2IsXi4RT3aM6BlKuSxICZaROXiioqKamppE4wLGGf/8B5Oo9e1yuaRUozSrqJ48Hx8Uy9FyWWdnZ2Zmpqz9YMbugNJq/3SJeCHr/J0R5Prpc1wSszf2jSq8oDjsd1sTKKpPhH6GSrwsUJA1GKZOnRoZGelbIIBy+GeOiYyMDAkJGRgYePLJJ3FhV1eXlGp0Fi5cuHDhQoZhTCaT2Wz2YY4xGAyBgYF//fUX+nJ3/vx5/MVq7O5lZ2dXVlZ2dHQUFxejkvDw8KGhoTt37qDvgDabTbqr0h24fv263W5/55130FvuVz+n03nlyhX0lb+jo+N///ufdAe4PPLIIwaD4aeffjp16tThw4clWjeZTHl5eQcPHnz22We1Wi2lpt/jEs3e9OnTw8PD//zzzyeeeAIXSh8eshwm2ho7ojGOMRwfoJyhEi8LQsgdPMDkRPxLkE6nczqdFy9epFfLzc1dv379mTNnenp6du/evX379rFUYxjm3LlzL7744s8//3zjxo0rV65UVVUlJSWJestn6tSpq1evLioqunLlypkzZ8rLy3NycsYYBeaxxx6LiIhob283m82oRKvVpqSkFBcXX7t27eLFi/hJaXh4uNPpvHDhAuW3atId0Ov14eHhn3/+ucPhuHjxYnl5OffT4uLiq1evomCxY6Ju8Ds6Ozu7uLg4PT3d65c8FOtBQUGZmZllZWVIy4TuJ98luXF5hSOavaKiovz8/NOnT1+9enXDhg2//PKLrOHBTxTFYb4tYpLlQo/Rh3CIcUlByhkq94TiIjp4+IN5eHhYevvAOCHloQ0S696zZw9Fcpyv9U18vCkqko+PouvJe4SfrvPfUvTD5brHp6SkBO9FhhASG9+0aZNv+xcQXZW1kQG3BewGv2UvVXaKfj7ROsJrZwQpuv1cl+Ru0MA9VrT75G5UQewjr0QJpYJoi59kUVuiJ5pXjPxwJO6w4JGwxQa3XPQMJXorK1jRjQ8ogxmYJPhT2x94wAD9fAAAxshk/J8/MEkA/XwAAMYIzDEAGSQRv3Llyol2BACA+xiYYwAyoJ8PAMDYUXCOEVUW8k16aHh4+OWXX/Y68MaNG6+++qper4+Ojt68efO9e/fo5YgXX3zxiy++wG+vX7++YsWKsLCwKVOmTJkyJTIy8q233lL0lyrcDEw2Iabh4eGjR4+C/iAAAGNBwTlGCRXu4eHhzMzMkZERr/LXXnvN7XazLHvixImTJ09u27aNXs4wzIULF1pbW7nf0/Pz810uF8uyTqfT6XSePHmyvb29oqLCvyFwAaFyAAAecCbwN20+/Naws7Pz/fff9zpwcHBQpVJxFZDi4uIo5Yj169dv3boVv3W5XAEBAX19fVxzp06dSkxMlBmWj8AvLwEAePAQuY+RqCpPFHXny4ALabYzDHPmzJmZM2ei/6mhA3fv3s0Xcp8zZ86WLVu8nOzv7w8JCeEqIPX19VHKGYZxOByHDh3iyrj29vYGBgbq9XqGYX799deHH344LCysrq4O/1G/p6fnpZde0mq1sbGxe/bsQb+2Gh+hct8U6UX9AQAAUBrxtTIpqvJEUXevdigy3Q6HIzs7u6Ki4umnn8ZGm5ub5QrUS2f//v1ms3nWrFm4xO12Y+knFFFHR0drayuW4SsoKAgMDLx06ZLVaj148CA3P0oLlctVpJfoDwAAgOLQb3MkqsoTRd1FJdBxBZPJtH79ei+jfCF3bgUhgXqPwH+SPf/+C/HcuXNZluWW4MpDQ0MqlQr9K/vEiROowsjIiFqtxv+prqmpwSYYZYTKuchVpPfBHwAAACUQv48hqso/99xz0dHRer0+NTXV6XRiUXeGYWpqaoh/quAfhcq3bNlSX1+fkpLCrewvgXoiP/zwQ0xMjJBY4cDAQGBg4MyZMxmGMRqNqLCvr8/tdnMl03F9WULlxAzQ8UGRXqI/AAAASuPL78osFsvixYsbGhpYlq2rq0OFaLns5s2bzc3NWVlZEo8aGhqqqak5dOjQpk2b+Pu/KsTevXuLioqEPuUumoludiILYgYk4neVeAAAgHFA9hyDBbcffvjh6OhovLuqyWRiWRaLuks8SqVS1dTUrFixIjU1devWrbg+EnJHr0UF6nU63dDQEJ6ibDabwWCglJ88eXLt2rV6vT45Ofn27dt6vV6v16tUKjSjIDHXmzdvMgyD758MBoNKpcKy5OfPn/dX3kTBKvHcQizhjv1RWsIdAADAB2TPMUKC216i7hKPUqvVjz76KMMwlZWV+/fvP336ND6EIlDvxbRp055//vmCgoKenh4kp48W64TKbTZbW1sbupnQaDQsy7Isq9PpXC7XH3/8MW3atPT09IqKip6enqqqKmRi6tSpZrO5qKioq6sLueSvvGG8hMq5//30iyI9AADA+OPLWtmRI0e+/vrriIiIxYsXz507F5evXLnS7XYLzQdCRyHmz5+fn5+Pf2ql0WhSUlKSk5PT09MTExNLSkroLh08eNDtdickJGRkZKSnp5eVlVHKo/8hIiJCpVKh18HBwYWFhV9++SXDMPv27auvr4+Pj09ISMAmqqqqRkZGEhISzGazbxd0ega0Wu3bb7+dnJz87bffdnV16XQ6/FFJSUlGRsaSJUvmzZtns9ni4+MZhvn4448jIiKSk5MzMzOzsrLWr1/vg0sAAACKMhm1/bu6uhISEu7cuTP+pkdHR6U8+bhw4cLixYuvXbs2Di4BAADcv4Am5r+Q+GidZVn+jQgAAADgRcBEO3DfsH379qioqKysrMuXL5eWluLlOAAAAEAIuI+RSkZGRnV1tdFozM3NLSwsXLNmzUR7BAAAMNmZjM9jAAAAgAcDuI8BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEAp/g8hP5ehAs9f1wAAAABJRU5ErkJggg==)

Screenshot: market.us vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	30 June, 2020 19:44 GMT
Vulnerability Verified:	30 June, 2020 19:57 GMT
Website Operator Notified:	30 June, 2020 19:57 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	30 June, 2020 19:57 GMT
Vulnerability Fixed:	4 July, 2020 09:07 GMT
—	—

JSON