proc-nn.ru Cross Site Scripting vulnerability OBB-1235073

2020-07-2216:30:00

raviakp1004

www.openbugbounty.org

JSON

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	proc-nn.ru
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	raviakp1004
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAANzklEQVR4nO2cf0xb1RfA37q269rHr/LK+GVW0OAyzWQEESYmc1smIQupP8ZQmTIkiEgWQnDOxmAlygx2C8JCiJkGF6KLMYQQY9AgaoMVocOua+rW4GS16yoDVuYbVuh43z+ueXm+Xzygha94Pn9x7rvvvHPuPfeed0/ftoGiKAwAAAAAIoBsrQ0AAAAA1i2QYwAAAIBIATkGAAAAiBSQYwAAAIBIATkGAAAAiBSQYwAAAIBI8X+RY9LS0i5cuCAkrj/WvYMAsMpcuHDhpZdeEukwPz//9NNP//7776tmEoBY+xxz8eLFhYWFBx54gFdcf6x7BwFg9SkrK9Pr9SIdFAqFUqmsr69fLYuAv1kkx1y9ejUqKor30szMzIkTJ4RE6fT29hYVFQmJ6w/awZs3bx45ckSn06WkpLz66qvz8/NrbdqaIRJmiO+++27nzp0ajSYvL+/ixYuRePTVq1fj4uLCqJmXtra2tLQ0jUbz0EMPff3112HRuejoLU/nKozGSmBuOFNTUw6Ho7a2Fok3b948fPhwfHw8a2XV1tb29/evjbn/YZZ/jgkEAk1NTUKidP6zOaasrGxubs5utw8MDFit1oaGhrU27f+XkpISk8nk9XoLCgrKy8vX2pxl0tbW1tLS8uGHH3o8nmPHjpWUlHz//fdrbdS/FeaGQ5KkWq3etGkTEsvLyxcWFhwOR39/v8ViobtptVqSJNfG3P8ylCjj4+M4jku5JNJTBJ/PFxsbOzc3xyuuP2gHZ2dnU1NTSZJE7cPDw/fcc8/a2raGLBo8BEF4vV6Koj7//PMdO3aE8dFerzcrKwv9kZOTE0bNXJKTkwcGBmixo6PjwIEDK1e7vKW3qM7Y2Njw6gwvTK+ZfweDQblcHggEkDg4OLh9+3ZuN2DVkHSOee+999LS0uLj4w8fPjwzM4Nh2MzMjF6vJ0lyw4YNH330EVM8depUVFTUu+++u2XLlri4uOeff/7PP/8U0tzb27t//36FQsES0fGfqwS1nzhxQqfTJSUlffDBBxiG3b59+8UXX9TpdHfdddebb755584dpO3OnTuvvfbali1bNBrNwYMHp6amuAYghSdPnkxLS4uLi3v22WeRg+KXWLcz7WEVLlg1B9rBzZs3//bbbxqNBrWPjY0lJydjGDYyMpKXl7d582adTnfw4MFr166JzAuvg0yzNRrNoUOHpqamXnnlFZ1OFx8ff+TIkdu3b6PbR0ZGHnnkkaioqJSUlCeffPLnn39m6eft8Ndff73wwgtRUVFbt25944036NHmtZx3voTmhRtmNNXV1YWFhS+//LLRaPz4448XNZKXX3/9VaPR/PTTTxiGTU1NxcXFffPNNykpKefPn8cwLCUl5ccff0Q9v/zyS5FhZ/XhGnDo0KG3336b7pmXl4fWiM/ny8/Pp9vLy8tPnz7N1cwbz1KiUaIqoRi7du3aY489FhUVde+997IGmcXKl6fEKBV6EGv/YdoWDAYXFhaUSiUSVSrV7Ows1wUpUwyEhcVzDEmSdrvdarUODw/7fL7jx49jGBYTE3Pp0iUcx4PBYGlpKVN8/PHHSZIcHh622Ww2m210dLS5uVlIuUihTEgJSZKXLl1yOp2dnZ1oxR49etTn842Ojvb19fX29ra3t6Oezc3N/f39/f39brc7OTnZ5XIJOehwOJCDHo/HaDRKucTsw7JHBN5K4OXLl+vr681mM4Zho6OjlZWVfr/f6XSmpqbW1NSgPjoOIg6iKRscHLTb7T6fb9u2bZOTkw6HY2hoaHx8nPbiwIEDZWVlHo9ncHAwPz9fpVKxDOPt0NjYODs763A4+vr6LBZLR0cH6ixkOXd8eM3mDTMaHMevXLnS2dnZ19d33333LWok74ilpaUZjUZUtW9oaCgsLHz00Ud5p6msrGzv3r0o93AZGRnZu3dvWVmZkAHFxcU9PT3o6vXr1+12u8FgIElSpVLRr1MYhikUiq1bt3L1C8WzlGiUokpopmpqaqKjo10u1xdffMHMMbyxt/LlKTFKeR/E2n+YLsfExGRlZRmNxvn5+T/++MNkMmVnZ3NHRnyKgXAifswZHx/HMOzWrVtItFqt6enp9CXeWhm6xePxoPbu7u7s7Gz0t8fj0ev19C0kSeI4Pj09zRWFlKB2+haKokKhENqAkNjb25ubm4v+TkhIGB0dXZKDg4ODTAeFLrFuZ9rDHRa65sDyF+H1etPT08+dO8e1bWxsLDExke7GQshBZBKzViCTyWZnZ5FotVpRUW56eloulweDQaGREepAEARd4rPb7bz1Jdpy7vjwmi0SZhRFnTlzZseOHX6/f/fu3QUFBUh/QkKCuBe8IzY3N7dt2zaTyUQQhN/vF/KdJMmmpiatVltcXOx2u+l2t9tdXFys1WqbmprQIPAaMDs7Gx0djaK3vb29qKiI+mdg1NfXEwRBEAQ3ooTiWTxQeUtAIkuDhp6pUCikUqmYK46OW+5Irnx5SoxSkc1EqFZGUZTL5crMzFQqlWq1GsOwr776ittNaIqBsLO032OYO6ZIjlGpVHS7y+VC2wFFUaFQyOfz0Ze6u7v37NnDKwop4S4nn8+nVCpp0e12ozUTCATkcnkoFGJ5RDBYqoPcCjXXHpG7WP4icnNzW1tbaXF0dHTfvn3JyckEQWi1WpGauJCD4mYzxZKSkszMzLq6OrPZ/O2333Ifwe0wPT2NYRg9gFqtlp5cXsu548NrtrjNdE7y+XwEQTQ1NQ0NDWVmZkr0ggX6sog55kJMT08bDAa5XE63yOVyg8FA74wiBpSUlKBH7Nu3r6uri6Ior9dLh3QgEPB6vUNDQ9z5FYpn6YG6qCremfL5fKwVJxJ7K1+eEqNUZDMRyTGIQCBw6tQpOifxduNOMRB25BE/KDHYuHFjUlISLa7CF2UbN25ktdjt9vA+QjpcB69fv+5wOH744Qe6xWAwVFRUdHR0qFQq9BkVakcFCiZjY2MYn4PS+eSTT86fP+90On0+X11d3a5du9ra2sQ7GI1GmUxms9nk8r8jRyaTiVvOi3Szb9y4MT09vXPnTgzDkpKSOjs7DQaDzWajy5JCXnBH7MaNGxiG+f1+mUzm9/vFn/vLL780NDRYLJbGxka6sbGx0Ww2V1dXNzY23n333SIGFBcXnz59urS0dHh4uLu7G8MwVNiZn59XKBQxMTExMTETExPoRXuVWdJMYXwjabPZImZd2FCr1S0tLby/eCF4pxgIP+IpaHnnGIxxvO3p6WG+StCEQiGCIOhDNEsUUsJ9ExGvldnt9jA6KOUcc+vWLZlMxqxpoLtYDtLGM1smJiaYr1R2u12kXiHkoPRzDBO73Z6amspt53bAcZxboBOynPcFk2u2iM2ohsOsZlRWVmIY5nQ6xb3gHbFAIJCYmHju3DmtVutyuYScraqqwnG8rq5ucnKSdWlycrK2thbH8aqqKhEDgsGgVqttaWl54okn6KvJycnMk5bZbEalPyYixaWlnmN4VQnNFKtW1tPTI71WtozlKf0cI7SZLHqOef/999EXg0y1dDeRKQbCy/JzDEmScrmcXvy0iMLiqaee8nq9TqczMzPTZDLRGujKtcViuf/+++l2liikhDeYKioqioqKPB6P0+nMysqiyyBNTU05OTkOh8Pr9dbU1FgsliU5KHKJ9oLXnpycnIqKCr/f73a78/Pz0V0sB7kDgkhISGhvbw8EAm6322AwiH8/yuugxNXrcrkKCgoGBgYmJyc9Hk9FRQX6jpa2R6hDVVVVbm4uem1vbm5ubGwUsZx3fLhmi9tcXV29a9cup9M5OTnZ2dlJEERiYuLrr78uYqQQ1dXVxcXFFEW99dZbu3fvFupWWlo6Pj4uomd8fLy0tFTcgGeeeSY6OvrTTz+l72ptbU1PTx8YGJiYmOjq6tJqtVarlaucN54XDdTgP0HVSF5VQjFmMBiYK068VrbC5bmkHMO7mTD3H4/HwyypURQVCoXS09N7e3uZjWNjY/RTFp1iIFwsP8dQFGUymdRqdWdnJ1M8efIkjuPvvPNOQkJCbGzsc889R/+Ux/rZ02g00qpYIurJVcIbxCRJVlZWEgSRmppqMpnoWn8oFDp27BhBECqVymAw8L6wLCPHLPoCNTY2tmfPHhzHt2/f3traiu5iOcg7nhRFWSyW7OxslUqVmJhYV1cnnmN4HZS4eufm5kwmU0ZGhlKpTEhIKC0t9fv9zHt5O1AUFQwGa2trU1NT1Wp1YWEh/YrKaznv+HDNFrc5GAweP35cr9erVKqsrKyurq4rV66o1WqLxSJkJC82mw3HcfRSHAwG9Xr92bNnRYZXCiIG9PT04DhOBz+itbVVr9crlcqsrCzmv5VhwhvP4oHKrU90dHQIqRKKMa/Xu3//fhzHMzIyzGazeI5Z4fKUnmOENhOKsf8Eg0HWYffs2bOsQwxFUZ999ll4/3EVIIVFcswyEDq5s8jIyBgaGhISJSr5F8FyEAD+vaza8pT+oKNHj3I/qGGC3irOnDkTJtMAqazqb/5MLl++LCKuP9a9gwCwhpjNZvHPeTZt2tTV1fXwww+vmkkAYu3/32UAAIAVolAoHnzwQfE+kGDWBMgxAAAAQKTYQFHUWtsAAAAArE/gHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKT4H4o3n01kx0noAAAAAElFTkSuQmCC)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAANzklEQVR4nO2cf0xb1RfA37q269rHr/LK+GVW0OAyzWQEESYmc1smIQupP8ZQmTIkiEgWQnDOxmAlygx2C8JCiJkGF6KLMYQQY9AgaoMVocOua+rW4GS16yoDVuYbVuh43z+ueXm+Xzygha94Pn9x7rvvvHPuPfeed0/ftoGiKAwAAAAAIoBsrQ0AAAAA1i2QYwAAAIBIATkGAAAAiBSQYwAAAIBIATkGAAAAiBSQYwAAAIBI8X+RY9LS0i5cuCAkrj/WvYMAsMpcuHDhpZdeEukwPz//9NNP//7776tmEoBY+xxz8eLFhYWFBx54gFdcf6x7BwFg9SkrK9Pr9SIdFAqFUqmsr69fLYuAv1kkx1y9ejUqKor30szMzIkTJ4RE6fT29hYVFQmJ6w/awZs3bx45ckSn06WkpLz66qvz8/NrbdqaIRJmiO+++27nzp0ajSYvL+/ixYuRePTVq1fj4uLCqJmXtra2tLQ0jUbz0EMPff3112HRuejoLU/nKozGSmBuOFNTUw6Ho7a2Fok3b948fPhwfHw8a2XV1tb29/evjbn/YZZ/jgkEAk1NTUKidP6zOaasrGxubs5utw8MDFit1oaGhrU27f+XkpISk8nk9XoLCgrKy8vX2pxl0tbW1tLS8uGHH3o8nmPHjpWUlHz//fdrbdS/FeaGQ5KkWq3etGkTEsvLyxcWFhwOR39/v8ViobtptVqSJNfG3P8ylCjj4+M4jku5JNJTBJ/PFxsbOzc3xyuuP2gHZ2dnU1NTSZJE7cPDw/fcc8/a2raGLBo8BEF4vV6Koj7//PMdO3aE8dFerzcrKwv9kZOTE0bNXJKTkwcGBmixo6PjwIEDK1e7vKW3qM7Y2Njw6gwvTK+ZfweDQblcHggEkDg4OLh9+3ZuN2DVkHSOee+999LS0uLj4w8fPjwzM4Nh2MzMjF6vJ0lyw4YNH330EVM8depUVFTUu+++u2XLlri4uOeff/7PP/8U0tzb27t//36FQsES0fGfqwS1nzhxQqfTJSUlffDBBxiG3b59+8UXX9TpdHfdddebb755584dpO3OnTuvvfbali1bNBrNwYMHp6amuAYghSdPnkxLS4uLi3v22WeRg+KXWLcz7WEVLlg1B9rBzZs3//bbbxqNBrWPjY0lJydjGDYyMpKXl7d582adTnfw4MFr166JzAuvg0yzNRrNoUOHpqamXnnlFZ1OFx8ff+TIkdu3b6PbR0ZGHnnkkaioqJSUlCeffPLnn39m6eft8Ndff73wwgtRUVFbt25944036NHmtZx3voTmhRtmNNXV1YWFhS+//LLRaPz4448XNZKXX3/9VaPR/PTTTxiGTU1NxcXFffPNNykpKefPn8cwLCUl5ccff0Q9v/zyS5FhZ/XhGnDo0KG3336b7pmXl4fWiM/ny8/Pp9vLy8tPnz7N1cwbz1KiUaIqoRi7du3aY489FhUVde+997IGmcXKl6fEKBV6EGv/YdoWDAYXFhaUSiUSVSrV7Ows1wUpUwyEhcVzDEmSdrvdarUODw/7fL7jx49jGBYTE3Pp0iUcx4PBYGlpKVN8/PHHSZIcHh622Ww2m210dLS5uVlIuUihTEgJSZKXLl1yOp2dnZ1oxR49etTn842Ojvb19fX29ra3t6Oezc3N/f39/f39brc7OTnZ5XIJOehwOJCDHo/HaDRKucTsw7JHBN5K4OXLl+vr681mM4Zho6OjlZWVfr/f6XSmpqbW1NSgPjoOIg6iKRscHLTb7T6fb9u2bZOTkw6HY2hoaHx8nPbiwIEDZWVlHo9ncHAwPz9fpVKxDOPt0NjYODs763A4+vr6LBZLR0cH6ixkOXd8eM3mDTMaHMevXLnS2dnZ19d33333LWok74ilpaUZjUZUtW9oaCgsLHz00Ud5p6msrGzv3r0o93AZGRnZu3dvWVmZkAHFxcU9PT3o6vXr1+12u8FgIElSpVLRr1MYhikUiq1bt3L1C8WzlGiUokpopmpqaqKjo10u1xdffMHMMbyxt/LlKTFKeR/E2n+YLsfExGRlZRmNxvn5+T/++MNkMmVnZ3NHRnyKgXAifswZHx/HMOzWrVtItFqt6enp9CXeWhm6xePxoPbu7u7s7Gz0t8fj0ev19C0kSeI4Pj09zRWFlKB2+haKokKhENqAkNjb25ubm4v+TkhIGB0dXZKDg4ODTAeFLrFuZ9rDHRa65sDyF+H1etPT08+dO8e1bWxsLDExke7GQshBZBKzViCTyWZnZ5FotVpRUW56eloulweDQaGREepAEARd4rPb7bz1Jdpy7vjwmi0SZhRFnTlzZseOHX6/f/fu3QUFBUh/QkKCuBe8IzY3N7dt2zaTyUQQhN/vF/KdJMmmpiatVltcXOx2u+l2t9tdXFys1WqbmprQIPAaMDs7Gx0djaK3vb29qKiI+mdg1NfXEwRBEAQ3ooTiWTxQeUtAIkuDhp6pUCikUqmYK46OW+5Irnx5SoxSkc1EqFZGUZTL5crMzFQqlWq1GsOwr776ittNaIqBsLO032OYO6ZIjlGpVHS7y+VC2wFFUaFQyOfz0Ze6u7v37NnDKwop4S4nn8+nVCpp0e12ozUTCATkcnkoFGJ5RDBYqoPcCjXXHpG7WP4icnNzW1tbaXF0dHTfvn3JyckEQWi1WpGauJCD4mYzxZKSkszMzLq6OrPZ/O2333Ifwe0wPT2NYRg9gFqtlp5cXsu548NrtrjNdE7y+XwEQTQ1NQ0NDWVmZkr0ggX6sog55kJMT08bDAa5XE63yOVyg8FA74wiBpSUlKBH7Nu3r6uri6Ior9dLh3QgEPB6vUNDQ9z5FYpn6YG6qCremfL5fKwVJxJ7K1+eEqNUZDMRyTGIQCBw6tQpOifxduNOMRB25BE/KDHYuHFjUlISLa7CF2UbN25ktdjt9vA+QjpcB69fv+5wOH744Qe6xWAwVFRUdHR0qFQq9BkVakcFCiZjY2MYn4PS+eSTT86fP+90On0+X11d3a5du9ra2sQ7GI1GmUxms9nk8r8jRyaTiVvOi3Szb9y4MT09vXPnTgzDkpKSOjs7DQaDzWajy5JCXnBH7MaNGxiG+f1+mUzm9/vFn/vLL780NDRYLJbGxka6sbGx0Ww2V1dXNzY23n333SIGFBcXnz59urS0dHh4uLu7G8MwVNiZn59XKBQxMTExMTETExPoRXuVWdJMYXwjabPZImZd2FCr1S0tLby/eCF4pxgIP+IpaHnnGIxxvO3p6WG+StCEQiGCIOhDNEsUUsJ9ExGvldnt9jA6KOUcc+vWLZlMxqxpoLtYDtLGM1smJiaYr1R2u12kXiHkoPRzDBO73Z6amspt53bAcZxboBOynPcFk2u2iM2ohsOsZlRWVmIY5nQ6xb3gHbFAIJCYmHju3DmtVutyuYScraqqwnG8rq5ucnKSdWlycrK2thbH8aqqKhEDgsGgVqttaWl54okn6KvJycnMk5bZbEalPyYixaWlnmN4VQnNFKtW1tPTI71WtozlKf0cI7SZLHqOef/999EXg0y1dDeRKQbCy/JzDEmScrmcXvy0iMLiqaee8nq9TqczMzPTZDLRGujKtcViuf/+++l2liikhDeYKioqioqKPB6P0+nMysqiyyBNTU05OTkOh8Pr9dbU1FgsliU5KHKJ9oLXnpycnIqKCr/f73a78/Pz0V0sB7kDgkhISGhvbw8EAm6322AwiH8/yuugxNXrcrkKCgoGBgYmJyc9Hk9FRQX6jpa2R6hDVVVVbm4uem1vbm5ubGwUsZx3fLhmi9tcXV29a9cup9M5OTnZ2dlJEERiYuLrr78uYqQQ1dXVxcXFFEW99dZbu3fvFupWWlo6Pj4uomd8fLy0tFTcgGeeeSY6OvrTTz+l72ptbU1PTx8YGJiYmOjq6tJqtVarlaucN54XDdTgP0HVSF5VQjFmMBiYK068VrbC5bmkHMO7mTD3H4/HwyypURQVCoXS09N7e3uZjWNjY/RTFp1iIFwsP8dQFGUymdRqdWdnJ1M8efIkjuPvvPNOQkJCbGzsc889R/+Ux/rZ02g00qpYIurJVcIbxCRJVlZWEgSRmppqMpnoWn8oFDp27BhBECqVymAw8L6wLCPHLPoCNTY2tmfPHhzHt2/f3traiu5iOcg7nhRFWSyW7OxslUqVmJhYV1cnnmN4HZS4eufm5kwmU0ZGhlKpTEhIKC0t9fv9zHt5O1AUFQwGa2trU1NT1Wp1YWEh/YrKaznv+HDNFrc5GAweP35cr9erVKqsrKyurq4rV66o1WqLxSJkJC82mw3HcfRSHAwG9Xr92bNnRYZXCiIG9PT04DhOBz+itbVVr9crlcqsrCzmv5VhwhvP4oHKrU90dHQIqRKKMa/Xu3//fhzHMzIyzGazeI5Z4fKUnmOENhOKsf8Eg0HWYffs2bOsQwxFUZ999ll4/3EVIIVFcswyEDq5s8jIyBgaGhISJSr5F8FyEAD+vaza8pT+oKNHj3I/qGGC3irOnDkTJtMAqazqb/5MLl++LCKuP9a9gwCwhpjNZvHPeTZt2tTV1fXwww+vmkkAYu3/32UAAIAVolAoHnzwQfE+kGDWBMgxAAAAQKTYQFHUWtsAAAAArE/gHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKSAHAMAAABECsgxAAAAQKT4H4o3n01kx0noAAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAXmUlEQVR4nO2dfUxT1xvHr5VBwRYF28pL/QnOoWOMMSQEF+aI2QvrGlLxdYxNlxFcDDJCJlF0jOmmTHHZHGNucYszy2aMMmIMIUvnDCPEMcbuEN/QOMBaEBGtIisV2t8fJzu56z333HtLL6B7Pn+1p+ee8zzPee49vee23zPF4/EwAAAAAKAAqok2AAAAAHhggTkGAAAAUAqYYwAAAAClgDkGAAAAUAqYYwAAAAClgDkGAAAAUAqYYwAAAAClgDkGAAAAUIpJMcc4HI6dO3ei111dXVqt1o+N+71Bib10dXWFhYXh11M4zJ49e/Pmzffu3RsfC7mW+B3u2HF7HIeYCzGxvY8nio6sbxDzAfgvMynmmFu3bu3YsWOirVAWjUbjdDqdTufQ0FBdXd3Jkye3bds20Ub5AeLYzZkzp7+/f0LsASaW/8K5DMhiUswx/xGCgoKCgoKCg4Mff/zxysrKI0eOTLRFChIUFDTRJgAAMPGIzzGjo6ObN2+eNWvWtGnTVqxYcePGDYZh7t69u27dOr1eP3v27Pfee290dJT5Z41i9+7ds2bNCgsLW7Nmzd9//80wzGefffbCCy/gBrds2bJmzRr81uFwxMTEDA4OTpky5ZtvvkGFn3zySWxs7MyZM1999VWHw4EKh4eH33jjDa1WO2fOnHfffRd1yuW3335btGhRcHCwXq9fsWLF1atX8Ucffvihl1VEL1atWvXBBx/goxYtWoRMEu1aLmq12ul0Sq9PdA0FfM+ePbGxsWFhYa+88gqO1dWrV1944QWtVjt//vzvvvuO36DQYAn19dtvvz399NNarTY6OnrZsmXnzp1jBMaO4axWUSz02Tt6OmH4I44a3Llzp16vj4yM/OqrrxhSDixdunT37t2okT///DMoKAjbvG7duo0bNwpFg5gkxE7pvtODRh9ZoeDw3fRaURRaduvp6XnppZe0Wm1sbOyePXtwHaKzQvkgNMTc3oWyUdalhoiQp7IaAXxGfI7ZtWuX1Wq1Wq0dHR1RUVFnz55lGKawsNBut7e2ttbX1x87dqy6uhpVHhwcbG5ubmlpaWlpaW1t3bVrF8MwFouloaHhzp07qM6xY8eys7Nx+9OnTz9//jxaSsrNzUWNsCzb1NTU3Nxst9s3bdqEam7btm1oaKitra2+vr6hoWHfvn1epra2tubn5/f29ra3txuNxoKCAmxVyz9gq4herFy5sra2Fn3a09PDsqzFYpHStSwcDkd5ebnJZJJ+CMW1trY2FKvu7u7S0lJUXlBQEBoaevbs2bq6OuIcwwgMllBfZrN57dq13d3djY2N6enparWaIY0dsReihT57R08nfCBxxAcHB8+fP9/e3n7gwIH09HSGlANms9lqtaL6x48fd7vd9fX16K3VakWjRoyGUJLwOxX1nRI0+sgKBUfohBWloKAgMDDw0qVLVqv14MGDuJzoLCUfhIaYO2TEbJR1qZGLXxoBRPCIYTAYWltbuSUjIyMajeby5cvo7bFjx9LS0jweT2dnJ8Mw3d3dqLympiYlJQW9TktLO3LkCKqDUpDbICrErxmGuX37Nnrb1NQ0d+5c9Fqn0w0ODqLXLMumpqZSzL506VJERATFKqIXQ0NDoaGhqHJ1dXVWVpbErrku4JIZM2ZwndL9Q2BgYE5ODm6QfywdL9dwrBobG1GsRkZG1Go112VsCdc8ocHi9zUwMBAQEOA1ahTjcaGQhWPxziMhnYiuofKBgQFck5gDdrs9JCQEtZmamlpcXJyTk4MODw0NdblcQtEgJgm/U1HfKY5LGVl+cIhueg0cN1258VGr1fhAbndCZ4SUZMZDzO1d+klKqU9EyFNZjQA+E0CfgRwOx8DAQGJiIrewr6/P5XLFxsaitwsWLECjxTCMWq2ePXs2Lu/u7kavLRbL8ePHly1bdvz4cZPJRF+s12g0+N42KipqYGCAYZibN2/29/fHxMSgcrfbHRDgbfwff/xRUlJy9uxZl8vldrvdbjfFKqIXwcHBJpOptrZ2w4YNNTU1a9euldi1KCEhISzLMgxjtVo3bdq0f//+4OBg6YcLucaNldFoRLHq6+tjGIbrMrFNocHi9xUWFrZ8+fK0tLQlS5ZERUWlpKQ888wzEi0nWjgW7xgJ6STkmkaj4a4IEXMgMjIyLi6uqakpPj7ebreXlZXFxcWNjo5ardZnn332oYceIkaDkiRenUrxXchxKSPLD05PT4/QCUunr6/P7XZzD0QvfDgjhIYYI/0kpdRnGEav1+M2r1+/TrdKqBHAj0i6Vk6dOnWM3WRnZ6NVguPHj6MLt1ycTqdKpWppacHZrFJ5L/RZLJa8vLx9+/ap1WqbzZaZmelDRytXrqyqqsrNzW1ubq6pqZHYNfrmOzo6imM1ODgYEhKCK6hUqujoaIZh1qxZU1lZuX///g0bNki3yi+ujaWv77///vfff29vb7fb7cXFxU899dSnn36qaI8Uxp5OdEwmk9VqvXz5stlsnj59elJSUkNDA14oY0jRKC0tFU0SIn4fWaWDw0g7I7wYtwRG3+SASYTonY7BYGBZllsi8Qa2traWe++ZkJBgtVpnzJiBFwEwXmtlQrfwGo3Ga9WOS19fX0BAAH7LsizxjhhbJeSF0+kMDw//+OOPs7OzcWv0rhEGg6GxsRG/ra6uzszMJDp16NAho9GIF1tElxcorhFj5bWiUltbK7pWhsMi1BcXlmWNRiPFeO5ameiCjFzvEPR0IrrGN1UoB5qamlJTU7Oysurq6jweT3V1dWFhYUREhN1u9/DA0SAmCX1wib5THJcysvzgEN28ffu2SqXirsgJrZV1dnait9y1MqEzguivaFLJPUnplxovhDyV1QjgM+JzzI4dO1JTU9va2mw2W0FBQUNDg8fjycvLy8rK6u7ubm9vT05O3rt3r+efMVu+fLnNZmtvb09KSiovL8ftlJWVJSYmms1mfheDg4MBAQEdHR0e6pXlzTffTEtLQ18ed+3atW3bNq92DAZDdXX1rVu3Ojo6LBYLN5OIVhG98Hg8OTk5oaGhhw8fxi2Ldu3xeKqqquLi4hoaGvr7+48cORIeHo6nHP6JFx8fv2/fPu6nzn8zMjIixTWhWFksFq7LQnMMMSz8vs6ePZuZmXnixIn+/v7u7u68vDw8jtyx4zYufY7xwTsPNZ2EXCNe/oRywGAwGAwG9D3AZrOFhoYmJSWhj4SiQUwS0S8QfN/pjouOLDE4RDdTU1Pz8vJ6e3s7OjrS09OJTS1fvtxisXR2dra3tycmJoqejMR8ILrJ/VTuSUq/1PAhekpphPjoEfAN8TlmZGSkpKREp9Op1WqLxdLf3+/xeAYHB/Pz83U6ndFoLC8vRxdEdG5UVFQYDIYZM2a89tprQ0NDuB10D3vgwAFiL+Xl5SEhIQcOHKCcYE6ns6ioyGg0hoSEmEwm/O0G09DQkJKSolarIyIiiouLuZeqXbt28a0ieuHxeGprazUaDdd40a4RH330UUxMTGBgYEJCQk1NDdcLrwvNt99+GxMT43K5PP/kuhd4BhJ1jRgrm832/PPPazSauLi4yspK4hwjNFj8vlwuV3l5eVxcXGBgoMFgyM3N7e3t5Y8d31+Jc4xc7zzUdBIaceLlXigHcnJyli9fjqulpKSUlpai10LRICaJ6BzD953uuOjIEoNDdPPSpUtLlizRaDTx8fF79+4lNtXb22s2mzUaTUxMTEVFhZSTkZ8PRDe5n1Ky0YdLDR+ip0KNyP0NDkBnisfj8deyW1dXV0JCAv7dpBd3797V6XR2u32yqV/8N6EP1uQH0omCQsG5cOHC4sWLr1275sc2EXKz0S/Ze7+fAvcL4/c//x9//DE9PR2uCIBfgHSioFBwWJadO3euf9sEHnhk/wbXNxwOR1VV1erVq8enO+DBBtKJgn+Ds3379qioqKysrMuXL5eWlpaVlfmlWeC/wzjdx+AVz/HpDniwgXSi4N/gZGRkVFdXG43G3NzcwsJComwPANAQfWKDhFQ94/Uo7H554JaZmVlRUcEtqa+vj4qKEqo/sdGjPITHb/FAjwOUX6uL1pdSrihjCdR4BlkuXNsmVcCFDJhwYwApiN/HjLNY9/0iC5+dnY2VzRC1tbVI3GwSIhRVbvl4DvT9MspExhKoySx9L8W2CR+4CTcAkMtk1Pa/L2Ths7KyWlpauL+xIYozTh6EojpR0b4vRhngM+EDN+EGALIQmWO4Yt1Hjx5lBFT3GZLWN1HVXFQknyvETVRQ96qJJNCnTZu2atWqGzdubNy4Ua/Xz5w58/XXX7979y6qSZEHl2seZtasWWlpafhW5tdff3U6nRkZGVIk0yni7dL14WVtZCC0NSQu91JlF9XPJ/ZO3BmBottPDKzcDRq4iA6f3I0q+GPEl68XMpjfF30rBCmZLMVHIRl/+g4LErfY8Bo4+hlKtFaWs0IbH/CHHpi0iMwxXLHupUuXCqnuMwJa33xVc1ki+UQFdS7InsbGRpZl7Xb7ggUL+vv729raTp061dnZiRXRKfLgYzGPu1xWW1trNpulC7sJibdL14eXu5EBHS9VdlH9fGLvxJ0RREXdvRiLX6LDJ3ejCv4Y8eXrhQzm90WRvpeYyVJ8JLojusOC9C02uIieoUKXBYnOyk0eYDIi+sRGSKedq7rvIWl9E1XNpYvkU/TkcU2GYW7duoXeNjY2qlQq/HffpqamefPmecQkj+Sa52WAWq1GAVmwYEFtba1H+N/pXs8qGQHxdt/04UU3MpDyzN/rI7p+PrF3oZ0RiHZKeXIr3S9K9LjI3aiCOEZSDCb2JXSsxEyW4qOQjL+QL0K2CZ3s3DqiZyjRWlnOcsEbHwhlTnd3d0xMDMUYYEKQ9/8Youo+I6z17aVqLksSXIqevEajmT59OnptNBpDQ0OxYH5UVBR6NkiRBx+LeQzDzJkzZ8GCBXV1dUlJSUjhg1KZbzlfvF2WPrysjQx8gK6fT+yduDOCqKi7Fz77JTp8cjeqkLIrgZDBxL4oSMlkKT4KuSPRFy+TiCc7RvQMpVwWpDjLyEyeqKiopqYmUb+AccY//8Ekan27XC4p1SjNKqonz8cHxXK0XNbZ2ZmZmSlrP5ixG6C0WDpdIl6od/7OCHLt9NkvidEb+0YVXlAM9ntfPqSootDPUImXBQqykmHq1KmRkZG+OQIoh3/mmMjIyJCQkIGBgSeffBIXdnV1SalGZ+HChQsXLmQYxmQymc1mH+YYg8EQGBj4119/oS9358+fx1+sxm5ednZ2ZWVlR0dHcXExKgkPDx8aGrpz5w76Dmiz2aSbKt2A69ev2+32d955B73lfvVzOp1XrlxBX/k7Ojr+97//STeAyyOPPGIwGH766adTp04dPnxYYu8mkykvL+/gwYPPPvusVqul1PS7X6LRmz59enh4+J9//vnEE0/gQunpIctgYl9jR9THMbrjA5QzVOJlQQi5yQNMTsS/BOl0OqfTefHiRXq13Nzc9evXnzlzpqenZ/fu3du3bx9LNYZhzp079+KLL/788883bty4cuVKVVVVUlKSqLV8pk6dunr16qKioitXrpw5c6a8vDwnJ2eMXmAee+yxiIiI9vZ2s9mMSrRabUpKSnFx8bVr1y5evIiflIaHhzudzgsXLlB+qybdAL1eHx4e/vnnnzscjosXL5aXl3M/LS4uvnr1KnIWGyZqBn+gs7Ozi4uL09PTvX7JQ+k9KCgoMzOzrKwMaZnQ7eSbJNcvL3dEo1dUVJSfn3/69OmrV69u2LDhl19+kZUe/EBRDOb3RQyyXOg++uAO0S8pSDlD5Z5QXESTh5/Mw8PD0tsHxgkpD22QWPeePXsokuN8rW/i401RkXx8FF1P3iP8dJ3/liIPLtc8PiUlJXgvMoSQZPqmTZt827+AaKqsjQy4LWAz+C17qbJT9PMpUu1eOyNI0e3nmiR3gwbusaLDJ3ejCuIYeQVKKBTEvvhBFu1L9ETz8pHvjsQdFjwSttjgloueoURrZTkruvEBJZmBSYI/tf2BBwzQzwcAYIxMxv/5A5ME0M8HAGCMwBwDkEES8StXrpxoQwAAuI+BOQYgA/r5AACMHQXnGFFlId+kh4aHh19++WWvA2/cuPHqq6/q9fro6OjNmzffu3ePXo548cUXv/jiC/z2+vXrK1asCAsLmzJlypQpUyIjI9966y1Ff6nCjcBkE2IaHh4+evQo6A8CADAWFJxjlFDhHh4ezszMHBkZ8Sp/7bXX3G43y7InTpw4efLktm3b6OUMw1y4cKG1tZX7PT0/P9/lcrEs63Q6nU7nyZMn29vbKyoq/OsCFxAqBwDgAWcCf9Pmw28NOzs733//fa8DBwcHVSoVVwEpLi6OUo5Yv3791q1b8VuXyxUQENDX18ft7tSpU4mJiTLd8hH45SUAAA8eIvcxElXliaLufBlwIc12hmHOnDkzc+ZM9D81dODu3bv5Qu5z5szZsmWLl5H9/f0hISFcBaS+vj5KOcMwDofj0KFDXBnX3t7ewMBAvV7PMMyvv/768MMPh4WF1dXV4T/q9/T0vPTSS1qtNjY2ds+ePejXVuMjVO6bIr2oPQAAAEojvlYmRVWeKOru1Q5FptvhcGRnZ1dUVDz99NO40+bmZrkC9dLZv3+/2WyeNWsWLnG73Vj6CXnU0dHR2tqKZfgKCgoCAwMvXbpktVoPHjzIjY/SQuVyFekl2gMAAKA49NsciaryRFF3UQl0XMFkMq1fv96rU76QO7eCkEC9R+A/yZ5//4V47ty5LMtyS3DloaEhlUqF/pV94sQJVGFkZEStVuP/VNfU1OAuGGWEyrnIVaT3wR4AAAAlEL+PIarKP/fcc9HR0Xq9PjU11el0YlF3hmFqamqIf6rgH4XKt2zZUl9fn5KSwq3sL4F6Ij/88ENMTIyQWOHAwEBgYODMmTMZhjEajaiwr6/P7XZzJdNxfVlC5cQI0PFBkV6iPQAAAErjy+/KLBbL4sWLGxoaWJatq6tDhWi57ObNm83NzVlZWRKPGhoaqqmpOXTo0KZNm/j7vyrE3r17i4qKhD7lLpqJbnYiC2IEJOJ3lXgAAIBxQPYcgwW3H3744ejoaLy7qslkYlkWi7pLPEqlUtXU1KxYsSI1NXXr1q24PhJyR69FBep1Ot3Q0BCeomw2m8FgoJSfPHly7dq1er0+OTn59u3ber1er9erVCo0oyAx15s3bzIMg++fDAaDSqXCsuTnz5/3V9xEwSrx3EIs4Y7tUVrCHQAAwAdkzzFCgtteou4Sj1Kr1Y8++ijDMJWVlfv37z99+jQ+hCJQ78W0adOef/75goKCnp4eJKePFuuEym02W1tbG7qZ0Gg0LMuyLKvT6Vwu1x9//DFt2rT09PSKioqenp6qqirUxdSpU81mc1FRUVdXFzLJX3HDeAmVc//76RdFegAAgPHHl7WyI0eOfP311xEREYsXL547dy4uX7lypdvtFpoPhI5CzJ8/Pz8/H//USqPRpKSkJCcnp6enJyYmlpSU0E06ePCg2+1OSEjIyMhIT08vKyujlEf/Q0REhEqlQq+Dg4MLCwu//PJLhmH27dtXX18fHx+fkJCAu6iqqhoZGUlISDCbzb5d0OkR0Gq1b7/9dnJy8rffftvV1aXT6fBHJSUlGRkZS5YsmTdvns1mi4+PZxjm448/joiISE5OzszMzMrKWr9+vQ8mAQAAKMpk1Pbv6upKSEi4c+fO+Hc9Ojoq5cnHhQsXFi9efO3atXEwCQAA4P4FNDH/hcRH6yzL8m9EAAAAAC8CJtqA+4bt27dHRUVlZWVdvny5tLQUL8cBAAAAQsB9jFQyMjKqq6uNRmNubm5hYeGaNWsm2iIAAIDJzmR8HgMAAAA8GMB9DAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASvF/PdCfluQ6mAsAAAAASUVORK5CYII=)

Screenshot: proc-nn.ru vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	22 July, 2020 16:30 GMT
Vulnerability Verified:	22 July, 2020 16:39 GMT
Website Operator Notified:	22 July, 2020 16:39 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	22 July, 2020 16:39 GMT
Vulnerability Fixed:	30 July, 2020 10:55 GMT
—	—

JSON