Lucene search

K
openbugbountyPrashantaswani9OBB:1237409
HistoryJul 25, 2020 - 8:04 a.m.

onelittledesigner.com Improper Access Control vulnerability OBB-1237409

2020-07-2508:04:00
prashantaswani9
www.openbugbounty.org
7

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: onelittledesigner.com
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: IAC (Improper Access Control) / CWE-284
CVSSv3 Score: 6.5 [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: prashantaswani9
Remediation Guide: OWASP Access Control Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAALEElEQVR4nO2db0hTbxTHb7Zs6d3M1Jlr/XIhKyJMQoaF0R+kwsawsgQ1LTKNMKmoMIla/8Uy+of0oqB8UdALWSNCYkQMGWIm17XMRMSGTbG1UqZOm97fi4ff5XL/Tee9qf3O59U9d89z7vec89wd73MV55EkiQEAAACABITNtAAAAADgrwV6DAAAACAV0GMAAAAAqYAeAwAAAEgF9BgAAABAKqDHAAAAAFIxe3uMVqttbW3lM4G5whwqnChSp+NkDuUKACbJLO0xHz9+nJiYWLduHacJzBXmUOFEkTodJ3MoVwAweYL0mK9fvyoUCs6PBgYGbty4wWdOE4vFYjQa+cxpQg+KESA9CvqxQB4ErhIdHT0dbX8B4hYOIVGKRJEq7OT79+95eXkxMTHLli07efLk6Oio6AIAYLYR+nPMr1+/rl+/zmdOE0l7DJ0VK1Z4PB7KpEchbkSh6ZnrSFE4iVL0B3pMQUGBXC53Op02m83hcJw/f150AQAw25DNtAAOent7Ozo6tmzZwmmKzsKFCyXyHBqzTU/ISFc40VMkilRhJ0NDQ+/evfN4PJGRkRiGVVZW5ubm3rx5U0QBADALmdRzzN27d7VabUxMzIEDBwYGBjAMGxgYSExM9Pl88+bNe/r0Kd28ffu2QqG4efNmfHx8dHR0YWHhyMgI8vP+/ftNmzYpFIply5bt3bv38+fPnJezWCzbt29fsGAB2xwaGiopKYmLi1u+fPmlS5fGx8ex/zZPqqurtVptdHR0Xl4eEolh2Ojo6OHDhxUKxYoVKy5evIjG06FvvNCjePjwIT1Axiw+t9++fduxY4dCoVi1atWzZ8+CjmcnhLER1Nvbu2vXLoVCodVqq6ur0ebbVONF42/cuBEXF5eQkPD48WN6LOPj4+fOnYuPj4+MjNy3b9+PHz/Q+aCpjoyMzMnJ+fHjx5kzZ+Li4mJiYg4dOjQ0NMSu4+7du6kv09bW1oULF1KCS0pKSkpK+BYMJ1SK+JYTW7lAxkSUSjnJycm5du0adX7Dhg1Pnz6NjIwcGRlBDQbDsLGxsfDwcPZcxgKg77jyxcsuOmfFJ3n3AYC4BO8xPp+PIAi73d7U1OR2u8vLyzEMi4qKam9vx3Hc7/fn5+fTzd27d/t8vqampubm5ubm5paWlqqqKuTKYDAcPHjQ5XI1NDSkp6fL5XLOKwpslJWVlbnd7paWlvr6eovFUlNTQ4l0OBxIpMvlqqioQOcvX748PDzscDjq6+ttNtvDhw8FIqVHceTIEXqAjJF8bktLS5VKZVtb2+vXr+k9hm980ISUlpaGh4d3dnZardba2lp6UaYUr8/na29vdzqdT548SU9Pp1+iqqrKarVardaOjg61Wt3W1hY01QRBNDQ0EAThdrtXr17t8XgcDkdjY2N3dzelhF44g8FgtVrRyVevXk1MTNTX1yPTarVu3bqVb8EIw5c9TuV8GRNRKuVk//79ZrMZnezt7SUIIisriyH+6tWrBQUF7LkhxMtZdHbFJ3n3AYDIkIJ0d3djGDY4OIhMu92+cuVK6iMcx+kjkYmmuFwudL6uri41NZUkSa/XK5PJ/H4/+youlysxMREd+3w+HMe9Xi/bDAQCOI53dXWhjywWS1paGltkQ0MDJTI2Ntbn86FjgiD0ej1DOV8UwsM43QYCAblcTg988eLFAuM5E0K/EHJIxUs5DCFeDMOolDJQqVQtLS2Mk8Kp/vXrF3XpsLCw4eFhZNrt9qSkJHRML5zb7Y6IiECR6vX6U6dO5ebmIm9KpbKzs5NzwfCBUsS3nDiVC2RMLKl0J8PDw0qlEg2rqakxGo0MkSaTKSMjIxAIsOeyFyQqusDtwy46u+IC0wFAUoK/j8FxnHp4V6vVXq836BS5XL58+XJ0vHr1apfLhWFYdHR0dnZ2Wlratm3b1Gp1amrq5s2bKbd2ux0dv3nzRq/XU/sDdLO/v39sbEyr1VKe0b3EEKnRaJDInz9/ejyexMREdH5iYkImE+H9E5/b/v5+DMPogQuPF0gIor+/f2Jigh4v9dFU48VxnPOX3AYGBrxeb3JyMuO8cKqjoqKoSyuVykWLFiFTrVZTb+PphUtISNDpdHa7fc2aNW63+8KFCzqdbnx83Gq1ZmRkyGQyzgWDYVhcXBwl6fv373SFfNnjU86ZMRGl0p0sWrQoMzPTbDYfP368rq7u4MGDdOUvX76sra1tamqaP38+ey4ffPHyFZ1R8aCLDQAk4o++83/+/PmHDx+cTqfb7T516tTGjRvv37+PYdj8+fMTEhLQGBF/o8zv94eFhTU3N1NftWFhIvw90FTdCoxnJ+T06dN/TBgF9WUnIozCZWZmWq3Wrq4ug8EQFRWVkpJis9msVmtmZqaAE4IgBD7lW04zIpXhZP/+/Q8ePMjPz29qaqqrq6POf/r06ejRo/X19TExMXxz+eCMl7PoY2Njk5we9KIAMF2EH3P4ntw5P+LcKzObzZxbHwRBaDQaxslAIBAbG0ttdLBNvg0cPpE4jrM3gqa/V8bplrFXZjabhWVwJoS9V9bd3Y1M+l5ZyPGyUalUBEGwY5lqqukmo3AkSdrtdr1ebzQaX79+TZJkTU1NWVnZ0qVL3W73JBeMcDjUcuLbK+OTLYpUthO/379kyZI7d+7s2bOHOun1epOSkp49e8ZINX3u4OBgWFgYfVuPnmF2vCRX0YUrTvLcfQAgBaH3GJ/PJ5PJOjo6GCa6D7Ozs3t6epxOZ0pKislkIkmyra1t586db9++9Xg8LperqKjIYDBQntFOsc1mW7t2LXWSYZIkWVRUZDQaXS6X0+lcv379vXv3hEUePXo0LS0N/exWVVV1+fJlkiQHBwdlMll7e3sgEGDMpQdFP6ZP4XNLkmRWVhY9cGEZnAlh6MnOzs7Kyuru7nY6ncnJyUF7DOeFOL9xqK3569ev6/V6h8PR09NTWlpqs9lCSzXdZBeOJEmVSqVSqdB1e3p6lEplSkoK+d8PJewFwwfSILCc2MoFZIsildNJbm6uUql88eIFMgOBQEZGRllZmZ8G51y9Xl9UVNTX19fR0ZGeno6kCsTLLjq74sJ3HwBIR+g9hiRJk8kUERHx5MkTulldXY3jeGVlpUqlWrx4cUFBAXonPDY2ZjKZdDpdeHi4SqXKz8/v6+tjXOX06dMVFRWUf4ZJkqTP5ysuLo6NjdVoNCaTCX3jC4j0+/0nTpzQaDQRERGZmZnUT4vl5eVIOftupAdFP6amCLjt6enZvn07juM6ne7WrVvCMjgTwtDT19dnMBhwHE9MTKysrAzaYzgvxI6R8bR09uzZ2NhYuVyelZXl8XhCSzXdZBeOJMnc3Nzs7GzKTE1NRWOQT/aC4QONF1hObOUCskWRyunEbDbjOE7FQr3QouDLVWdn57Zt23AcX7Nmzb1799AwgXjZRWdXXGA6AEhKkB4TAkGf0wXQ6XSNjY185v+c9vZ2lUo10yomxZQKN9UFM50FxkYUqdNZqLDIgb+b2fV3/l++fBEw/+cQBLFy5cqZVjEp5lDhRJE6HSdzKFcAEAKzq8cADK5cuaJWq41GY1dXV0VFxYULF2Za0Qzz+/dvu92u0WhmWggAAJMCesysZsuWLSdOnDh27Ng///xTVlZWWFg404pmmOLiYovF8ujRo5kWAgDApJhHkuRMawAAAAD+Tmbp/ygDAAAA/gKgxwAAAABSAT0GAAAAkAroMQAAAIBUQI8BAAAApAJ6DAAAACAV0GMAAAAAqYAeAwAAAEgF9BgAAABAKqDHAAAAAFLxL3/+fZqGKQB3AAAAAElFTkSuQmCC)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAVwklEQVR4nO3df0xT5/4H8CN2WOEU7IDyqw5qTGfM4oiXNLiwO0eI43Kbpm7obpCpN+OKMYxwiTNKblzndtUL82ZDQ/xju0H/cMv+MB1ZDLlpNtOQxiBjlVuR2xCGFSthpQNuxdpbON8/nu9OTs6vltLDD+/79VfP6TnP+Tyf52k/9Kk9rmMYhgIAAFBAykoHAAAAzyzUGAAAUApqDAAAKAU1BgAAlIIaAwAASkGNAQAApaDGAACAUlBjAABAKWujxty/f1+r1cofMzMzc+7cueWJ59nDzd79+/c1Go2il5O5xMqOYzwzLWHLnGQpvEvjhQOKWhs1Jh7T09Nnz55d6SjWqtWTvdUTSdKtzq6tzqjgmfHs1BgAAFhtYtQY3sdq7krC7du3X331VY1GU1hY+NZbb927d4+iqKdPn7777rsajaaoqOiDDz6Yn59nGzl37lxOTk5+fv4XX3whdTrXw4cP33jjDY1G8+KLL167do3df/v27V27dm3cuDEnJ2ffvn0PHz6kKGpmZqa4uDgUCq1bt+7KlSuix/AIQ/3pp5/S09N//PFHiqKmpqa0Wu33339Pgm9vb8/NzdVqtYcOHXry5Alp4fHjxw0NDTk5OZs3b/7www9JZ0W7JpNG0eSIpjHhQYnZIC97ZOdnn31mMBiysrLeeeedmZmZeNqRCky0j6KEkUglmXtF4eiIXlGqKdGZJpPk+fn5U6dO5ebmpqen79u3b2pqavmTHM+EkemCfFQASZT45xiz2Xz48GGfz9fb21teXq5WqymKOnPmzNzc3ODgYE9Pj9PpvHz5Mjk4FAoNDw97PJ6urq7y8nKp07kaGxszMjKGhoZu3LjBrTEDAwNHjhyZmJjweDx6vb6xsZGiqMzMzOHhYZqmw+FwXV2d6DE8wlANBkNra2tzczNFUadPn66urn799ddJ8H19ff39/f39/QMDA21tbaSFpqYmv98/MDDQ09PT3d3d2dkpkxkZwuRIpTGxQYnZIC97JCS32+1yufr6+vx+/8mTJ+NpZ1F9FCWMRCrJ3JZFR0d4RammpGaalLa2NofD4XA4vF5vQUHB0NBQPMlJYpKTOGGEUQEkGSNrbGyMpmnu5qZNmxiGCQaDKpUqHA7zjs/Ozg6FQuSx2+02mUzkLIqigsEge5jU6axoNKpWq30+H9m8fv06uS7PyMhIXl6eaKiix8QMNRKJbNu2zWazZWdnT0xMsMFzIyktLSUR0jQ9OjpK9nd3d5eVlUl1TSqNosmRii1mazJZlW+Q1yYJaXZ2lmy6XK4tW7YsJTBhH6UGi/eUVJK5B4uOjvCKUk1JzTSZIdPpdAMDA8LIly3JcU4YmeHg7ZcaC4ClUyVWmbRabU1NTVlZWUVFRUFBQWlp6WuvvfbLL78EAoHi4mJyzMLCgkr1/+3TNM39nC56Orf9yclJiqI2b95MNrdt28Y+9eOPP544cWJoaCgSiSwsLCwsLAjDi3mMVKjPPffcpUuXKisrOzo6cnNzybNqtZobic/nIxFGIhGDwcDuJy/+mF0T4iVHJo3ypC6dQIM0TbPLLAUFBcFgcCmBCfsYJ6kkc4mOjvCKUk3JzDRRMzMzwWBwx44dvP3LmeRkTRiAZZD4XPzyyy9/+OEHj8fj9/tbWlpeeeWV1tbWlJSU/v5+doqnpEiuxQlPv3jxYjzXtVqt9fX1ly9fVqvV4+PjVVVVCRwTDoelQp2YmEhJSZmYmIgnmDi7dvz48fhPl4ktgUtfvHhxKQ0mK7BnzPr163l7VjDJGBdY1eQ/5szOzqakpLCf6Ht7e0XXrNxut16vZxiGpmnhMkLMD+Ps6SzeCobdbifXnZycVKlU3BO5i07kKjLHcImGOj09nZeX99VXXz3//PNDQ0OMYDXGbrfLr5WJdk0mjaLJEY2NtdhBidkgI1jGkVomSiwwYR8VWitjR0fYfpxrZexMk0myTqdzu93CyJcnyfFPmDiHA2tloKgYNYZhGJPJVF9fPzEx4fV6y8vLyTQdGhqqqqr67rvvAoGAz+err683m80Mwxw9erSsrIz8Hd3W1nbmzBlGbBJLnc5ltVpramrGx8c9Hk9JSQn3Fd7Z2Tk9Pe31eq1WK7s/FAqpVCqv1ytzDJdoqMeOHdu/fz/DMB9//PHu3buZX9/FuJHYbDbSQn19vcVi8fl8Ho9n586dHR0dMl0TTaNocqRiS3hQ4mmQmz2Zt7/EAhP2cXZ2VqVSDQ8PR6NRmUikksyNTXR0RLMq1ZTUTJMasrNnz5pMpsHBwfHx8cbGRqfTuZxJXtSEEe0CL/m8hAMkV+waMzIyUlFRQdP09u3bOzo6yDSNRCI2m81oNKampup0urq6OvINeTgcbm5u1uv1aWlp1dXV5M9G4atC6nSu8fHxPXv20DRtNBo/+eQT9hXodDpLS0vVanVeXl5LSwu3fthstrS0tK6uLpljWMJQ+/v7aZomf9KGw+Hi4uKrV6+S4M+fP6/T6TZt2nTw4MG5uTnSQigUOnLkSHZ2tl6vt9ls5BUr1TXRNIomRyqNCQ9KPA1ysyfz9pdYYKJ9PHnyJLmcTCRSSebGJjo6oleUakpqpkkNWTQaPXHiRHZ2tlqttlqtgUBgOZO8qAkj1QVe8rkJB0iudQzDrNxC3Rpw//79l1566T//+c9KBwIiMDoAqxy+GwQAAKWgxgAAgFJQYwAAQCmLu19ZEg9eK4qKirDcv2phdABWuRg1pqioKBAILE8oAADwjIm9VrZhw4ZliAMAAJ498a6VkQcXLlwwGAxarfbAgQPsrch5/va3vyV8o/W9e/e2t7eTdu7cubNhwwb2Kg0NDe+//378966P/37yAACgkEV85x8KhQYHB8mtyH0+X2trq+gx/b9K4EbrZrPZ4XCQU7799tuFhYWenh6y6XA4qqurF3Xv+jjvJw8AAEqR/4km+6Ni3q3Ie3t72VuRcw+mlnajdb/fn5aWRu5ObzKZWlpaamtrSQsZGRnkRmRx3rte9BboAACwnBZx32Xurcj1ej25FTnPEm+0np+fbzQaXS7X9u3b/X7/6dOnjUbj/Py8w+GorKzMyclZ1L3rE7ufPAAAJMuq+38mqqurHQ7H6Oio2WzOzMwsKSlxOp1koYxazL3rI5HIivYDAACS/RvMcDj84MED8tjr9b7wwguih+l0utTU1J9++olsDg8Ps59CyFcy3d3dFouFoiir1Wq322/evElqDEVRv/nNbw4dOnTq1Kl//OMfdrudoqj8/Py0tLRgMFj4q/z8/OT2CwAAEpD83/m3tLQ8fPjw7t27NpvNbDaLHrN+/fo//OEPzc3NDx48IEfW1taSp3bt2jU2Nnbr1q2KigqKoiwWS1dXV15eXn5+/r179373u999//33U1NTDx48uHTpUklJCTmrrq7u2LFjd+/effToUXt7+0cffZT0fgEAwGIlucbQNG0ymXbu3FleXr5jx44TJ05IHfnpp5/m5eXt3LmzqqrKYrEcO3aMfaqysvK3v/0t+V1OYWGh0WgkH2K2bt1aVlZ29OhR8mVMOBz+/PPP2dbKysqqqqq2bt168+bNurq65PYLAAASgHv7AwCAUnBPTAAAUApqDAAAKAU1BgAAlIIaAwAASkGNAQAApaDGAACAUlBjAABAKagxAACgFNQYAABQCmoMAAAoBTUGAACUghoDAABKQY0BAACloMYAAIBSUGMAAEApqDEAAKAU1BgAAFDK6q0xBoPhzp07UpuwVqyhgUtKqEtpZA3lCiBOq7TG/Otf/1pYWHj55ZdFN2GtWEMDl5RQl9LIGsoVQPxi1Jj79+9rNBrRp2ZmZs6dOye1uUTd3d0Wi0Vqc4m4neJ1kNsL7mOZPMhcRavVLiW2Z0ByB45QKEVJCVW+kZ9//vnAgQNZWVmFhYV//vOfnz59mvQAAFabxD/HTE9Pnz17VmpziRStMVxFRUWBQIDd5PYiuT1KLJ61TomBUyhFy1BjDh48qFarPR6P0+kcHBz8y1/+kvQAAFYb1UoHIOLRo0der3f37t2im0m3YcMGhVpOzGqLJ2HKDVzSU5SUUOUbefz48c2bNwOBQHp6OkVR58+fr62tbW9vT2IAAKtQXJ9jPvvsM4PBkJWV9c4778zMzFAUNTMzU1xcHAqF1q1bd+XKFe7m3//+d41G097enpubq9VqDx069OTJE9LO7du3X331VY1GU1hY+NZbb927d0/0ct3d3Xv27HnuueeEm48fP25oaMjJydm8efOHH344Pz9P/bp4cuHCBYPBoNVqDxw4QIKkKOrp06fvvvuuRqMpKir64IMPyPFc3IUXbi8uX77M7SDvLKlmHz58+MYbb2g0mhdffPHatWsxjxcmhLcQ9OjRo9///vcajcZgMFy4cIEsvi22v+T4c+fO5eTk5Ofnf/HFF9y+zM/Pnzp1Kjc3Nz09fd++fVNTU2R/zFSnp6e//fbbU1NT77//fk5OTlZW1h//+MfHjx8Lx3Hv3r3sm+mdO3c2bNjABtzQ0NDQ0CA1YUSxKZKaTsLIZTKWxFDZRt5+++2//vWv7P5du3ZduXIlPT39yZMnpMBQFBWJRFJTU4Xn8iYAd8VVqr/CQRcd8ThffQDJFbvGhEIht9vtcrn6+vr8fv/JkycpisrMzBweHqZpOhwO19XVcTf37t0bCoX6+vr6+/v7+/sHBgba2tpIU2az+fDhwz6fr7e3t7y8XK1Wi15RZqGsqanJ7/cPDAz09PR0d3d3dnayQQ4ODpIgfT5fa2sr2X/mzJm5ubnBwcGenh6n03n58mWZnnJ78ac//YnbQd6RUs02NjZmZGQMDQ3duHGDW2Okjo+ZkMbGxtTU1JGREYfDcfXqVe6gLKq/oVBoeHjY4/F0dXWVl5dzL9HW1uZwOBwOh9frLSgoGBoaiplqt9vd29vrdrv9fv+2bdsCgcDg4OCtW7fGxsbYSLgDZzabHQ4H2fntt98uLCz09PSQTYfD8frrr0tNGHlS2RONXCpjSQyVbWT//v12u53sfPTokdvttlqtvOA//vjjgwcPCs9NoL+igy4c8ThffQBJxsgaGxujKGp2dpZsulyuLVu2sE/RNM09kmySU3w+H9l//fr10tJShmGCwaBKpQqHw8Kr+Hy+4uJi8jgUCtE0HQwGhZvRaJSm6dHRUfJUd3d3WVmZMMje3l42yOzs7FAoRB673W6TycSLXKoX8oeJNhuNRtVqNbfjmzZtkjleNCHcC5EG2f6yDSbQX4qi2JTy6HS6gYEB3k75VE9PT7OXTklJmZubI5sul2vr1q3kMXfg/H5/Wloa6anJZGppaamtrSWtZWRkjIyMiE4YKSRFUtNJNHKZjCUrVG4jc3NzGRkZ5LDOzk6LxcIL0mazVVZWRqNR4bnCCUkGXeblIxx04YjLnA6gqNjfx9A0zX54LygoCAaDMU9Rq9WbN28mj7dt2+bz+SiK0mq1NTU1ZWVlFRUVBQUFpaWlr732Gtusy+Uij//5z3+aTCZ2fYC7OTk5GYlEDAYD2zJ5LfGC1Ov1JMhffvklEAgUFxeT/QsLCypVEr5/kmp2cnKSoihux+WPl0kIMTk5ubCwwO0v+9Ri+0vTtOg/cpuZmQkGgzt27ODtl091ZmYme+mMjIyNGzeSzYKCAvbbeO7A5efnG41Gl8u1fft2v99/+vRpo9E4Pz/vcDgqKytVKpXohKEoKicnhw3p559/5kYolT2pyEUzlsRQuY1s3Lixurrabre/9957169fP3z4MDfyb7755urVq319fevXrxeeK0Wqv1KDzhvxmJMNQCHL+p3/l19++cMPP3g8Hr/f39LS8sorr1y8eJGiqPXr1+fn55NjkvgvysLhcEpKSn9/P/tWm5KShN8DLbZZmeOFCTl+/PiyBcZi3+ySiDdw1dXVDodjdHTUbDZnZmaWlJQ4nU6Hw1FdXS3TiNvtlnlWajqtSKi8Rvbv33/p0qW6urq+vr7r16+z++/evXv06NGenp6srCypc6WI9ld00CORSJynx7wowFLJf8yR+uQu+pToWpndbhdd+nC73Xq9nrczGo1mZ2ezCx3CTakFHKkgaZoWLgQtfa1MtFneWpndbpcPQzQhwrWysbExssldK0u4v0I6nc7tdgv7sthUczd5A8cwjMvlMplMFovlxo0bDMN0dnY2NTXl5eX5/f44J4x8d9jpJLVWJhV2UkIVNhIOh59//vlPP/30zTffZHcGg8GtW7deu3aNl2ruubOzsykpKdxlPW6Ghf1lxAZdfsQZiVcfgBISrzGhUEilUnm9Xt4meR3W1NSMj497PJ6SkhKbzcYwzNDQUFVV1XfffRcIBHw+X319vdlsZlsmK8VOp/Oll15id/I2GYapr6+3WCw+n8/j8ezcubOjo0M+yKNHj5aVlZG/3dra2s6cOcMwzOzsrEqlGh4ejkajvHO5neI+5p4i1SzDMFarldtx+TBEE8KLp6amxmq1jo2NeTyeHTt2xKwxohcSfcdhl+bPnj1rMpkGBwfHx8cbGxudTmdiqeZuCgeOYRidTqfT6ch1x8fHMzIySkpKmF//KBFOGCkkBpnpJIxcJuykhCraSG1tbUZGxtdff002o9FoZWVlU1NTmEP0XJPJVF9fPzEx4fV6y8vLSagy/RUOunDE5V99AMpJvMYwDGOz2dLS0rq6uribFy5coGn6/PnzOp1u06ZNBw8eJN8JRyIRm81mNBpTU1N1Ol1dXd3ExATvKsePH29tbWXb520yDBMKhY4cOZKdna3X6202G3nHlwkyHA43Nzfr9fq0tLTq6mr2r8WTJ0+SyIWvRm6nuI/ZU2SaHR8f37NnD03TRqPxk08+kQ9DNCG8eCYmJsxmM03TxcXF58+fj1ljRC8k7CPv09KJEyeys7PVarXVag0EAomlmrspHDiGYWpra2tqatjN0tJScgxpUzhhpJDjZaaTMHKZsJMSqmgjdrudpmm2L+wXWiypXI2MjFRUVNA0vX379o6ODnKYTH+Fgy4ccZnTARQVo8YkIObndBlGo/HWrVtSm//jhoeHdTrdSkcRl0UN3GInzFImmFBSQl3KRMUkh2fb6vqd/7///W+Zzf9xbrd7y5YtKx1FXNbQwCUl1KU0soZyBZCA1VVjgOejjz4qKCiwWCyjo6Otra2nT59e6YhW2H//+1+Xy6XX61c6EACIC2rMqrZ79+7m5uZjx4698MILTU1Nhw4dWumIVtiRI0e6u7s///zzlQ4EAOKyjmGYlY4BAACeTav0/ygDAIBnAGoMAAAoBTUGAACUghoDAABKQY0BAACloMYAAIBSUGMAAEApqDEAAKAU1BgAAFAKagwAACgFNQYAAJSCGgMAAEpBjQEAAKWgxgAAgFJQYwAAQCmoMQAAoBTUGAAAUApqDAAAKAU1BgAAlIIaAwAASkGNAQAApaDGAACAUlBjAABAKagxAACglP8DVd9anuuevIwAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAKQElEQVR4nO2aX0hT7x/HT7Zy6vHPUuefJmkXSyRKQoaFVoqUjCFm2oXZH2hoyBDzQszAloSa1kUW4kWBdlFeiUiIF6PAREKXmqwlIqZjjiFqzk62RHd+F8+vw+Gc55wdZ/ua8nld7Ryfz9+9nz47z2kfTdMEAAAAAPiBgJ1OAAAAANizwIwBAAAA/AXMGAAAAMBfwIwBAAAA/AXMGAAAAMBfwIwBAAAA/AXMGAAAAMBfwIwBAAAA/MXumDFzc3MKhUJ8jcvlamxslO4wNDSU85l9c6vpCRnyM/c5yr+DlK+DbyLSIvGG/Pcd22bEO3fuBAUFdXZ2bsmKLeB/TSRS8uGs2dJ+JHwSFbAr2B0zRgorKysNDQ0+GB45cmRxcXE7obfkYfvh9hh7rCFLS0utra0fP34sKSnZkqHPAv5H4HyPu70c4G8h2+kE/gkCAwP/Sw/bD7fH2EsNoSgqODj45MmTO53IDrCXvkfgb+HlOYbz/Mt+nh0ZGcnMzAwNDT18+PDly5e/fv1KEMTv379v3boVGhp65MiR+/fvb25uMk4aGxujo6Pj4uJevnwpZM5mfn7+4sWLoaGhx44de/36NXN/ZGTk9OnTQUFB0dHRRUVF8/PzBEG4XK7ExESKovbt29fZ2YldI7FGxJcvXyIjIz98+IAusXUJeRDKHLvYax+wob99+xYSEjI2NkYQxNLSkkKheP/+PfLc0tISExOjUChu3Ljx69cv5OTnz59lZWXR0dEJCQkPHjxAToRCYyOKF0UQxKVLl1paWtDnz58/BwYGulwudFlWVoZ+0j59+jQpKSkyMvLatWvMX9kN2dzcvHv3bkxMTEhISFFR0dLSEuMfa8sgZMhXAgr35MmTpKQkhUJx9epVvjfEo0eP+J0UV8LS0hJbh0Lbh78jOAIWKVn6FmPDt9qqhDjwFcUull+Ob6IC9gC+n5XpdLqbN2/abLbBwcGMjAy5XE4QRH19/dra2sTERH9//8DAQHt7O1pMUdTk5KTFYuno6MjIyBAyZ2MwGMLCwqxWa19fH1t/o6OjpaWlTqfTYrGoVCqDwUAQRHh4+OTkJEmSbre7pKQEu0Y6LperoKCgqakpMzMT3RGqC4tQ5tLbyAYbOikpqba2trKykiCIuro6rVablZVFEARFUcPDw2az2Ww2j46ONjc3IycVFRUOh2N0dLS/v7+3t7etrU0kNDai16J0Op3JZEKf37596/F4+vv70aXJZMrKyqIoanx8fGhoaHh42OFw1NTU8J00NzebTCaTyTQ1NRUfH2+1WtF9r7ZChlglUBQ1MTGBvNlsttraWn4mFEWZ/8DupLgSIiMj2Trku2X7Z+8IjoBFSpa+xdjwrbYqIQ5YRTHwy/FNVMBegBZldnaWJEn2ZUREBE3Ty8vLMpnM7XZz1kdFRVEUhT6Pj49rNBpkRRDE8vIys0zInGFjY0Mul9tsNnTZ3d2N4nKYnp6OjY3Fpopdg62L+cx80Gq15eXlXuvCevOaOXux1z6IhF5fX09OTjYajVFRUU6nk/7TZ3botLQ0lBJJkjMzM+h+b29venq6SGh+RClfh8PhCA4ORg41Gk1VVVVxcTHKKiwsbHp6miCI1dVVtHhoaOjo0aP8hiiVytHRUY5nVBfWlgFryAEpgeNtcHCQ702ok9jm8G350mIuUd/4O4JvKFSyxC3GAWslXUKcQrCK4hfLvvRNVMAewMf3MQqForCwMD09PTs7Oz4+Pi0t7dy5c9+/f19cXExMTERrPB6PTPZ//yRJsv/TCNac7X9hYYEgiISEBHSZnJzM/GlsbKy6utpqta6vr3s8Ho/Hw09Pyhoh7t2719/f/+LFC+aOSF18RDLn47UPIqEPHDjw/PnznJyc1tbWmJgYdFMul7ND22w2lNL6+npSUhJzf3Z2Vig0NqKUouLi4tRq9dDQUEpKisPhqKurU6vVm5ubJpMpJydHJpORJMmcpcTHxy8vL3M8uFyu5eXlEydO8J2L24oYYpXA9qZSqfiZCHVyS0oQh7MjsAv4JUvfYmyErKRLiANWUSK1+CwqYA/g+zv/N2/efPr0yWKxOByOqqqqM2fO1NbWBgQEmM1mRvcBAYJncXzzZ8+eSYmbn5+v1+vb29vlcrndbs/NzfVtDZa1tbXu7u6uri6DwVBQUBAeHk4QhNvtll7XVhHvg3hop9MZEBDgdDr/YujtFKvVak0m08zMjE6nCw8PT01NHRgYMJlMWq1Welb79+/fciXChj4rAYtfleC/BESstikhiex434CdRPwxZ3V1NSAggH2wgH2eHR8fV6lUNE2TJIk968CeYvHNGTjP0T09PSjuwsKCTCZjGzL5MFFE1mBTYp+VyWQyq9VK07ROpzMYDMx6bF1Yb0KZS+kGvw8ioVdWVmJjY7u6ug4dOoRy5hx09PT0iJyViYTmR/RaFGJoaEij0eTl5fX19dE03dbWVlFRERsb63A4hE6NaN5Z2fj4OMetiC0D1hCrBCnehDqJbY5ItkLbB6sBKYdsQgl43WJYK+kS2v5Zmc+iAnY7XmYMTdMajUav1zudzqmpqYyMDKQDq9Wam5v77t27xcVFm82m1+t1Oh1N07dv305PT0c/jZubm+vr62ncBhAyZ5Ofn19YWGi32y0WS2pqKqM/pVLZ1ta2srIyNTWVn5/P3KcoSiaTTU1NiaxhWF1dlclkk5OTGxsb/PcxNE1PTk7K5fKJiQl0ia2LgVOgUOb8xVL6IBS6vLz8ypUrNE0/fPjw/Pnz9J9/INihjUYjWqzX6/Py8mw2m8ViOXXqVGtrq0hobETxohiUSqVSqURvZex2e1hYWGpqKr9FQjOmoaFBo9FMTEzY7XaDwTAwMCBuy4A1pHFKkD5jsJ0UVwI/W+z2wY4EtoBFkpS4xThgraRLiL1fkEO+ojg5sMsRSkCiqIBdjfcZMz09nZ2dTZJkSkpKa2sr0sH6+rrRaFSr1QcPHlQqlSUlJeidodvtrqysVKlUwcHBWq0W/dLhbwAhczZ2u/3ChQskSarV6sePHzP6GxgYSEtLk8vlsbGxVVVVbF0ajcbg4OCOjg6RNQw1NTVoMXbG0DRdUVFx9uxZ9BlbFwPHUChz/mIpfcCGNpvNJEmi34ButzsxMfHVq1fIc1NTk1KpjIiIuH79+traGnJCUVRpaWlUVJRKpTIajRsbGyKhsRHFi2IoLi4uLCxkLtPS0mpra/ktEpoxGxsb1dXVUVFRcrk8Pz9/cXFR3JYBa0jj1CJxxpAk2dzczO+kuBL42WK3j9BIYAQskqTELcaBb7VVCTH7BV3yFcXPgSlHKG2JogJ2Nftomt6ZQzrgbzM3N3f8+PEfP37sdCLAbgUkBPx14M0bAAAA4C9gxgAAAAD+AmYMAAAA4C/gfQwAAADgL+A5BgAAAPAXMGMAAAAAfwEzBgAAAPAXMGMAAAAAfwEzBgAAAPAXMGMAAAAAfwEzBgAAAPAXMGMAAAAAfwEzBgAAAPAXMGMAAAAAf/E/E3KA2NWRw9sAAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 25 July, 2020 08:04 GMT
Vulnerability Verified: 27 July, 2020 08:47 GMT
Website Operator Notified: 27 July, 2020 08:47 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 27 July, 2020 08:47 GMT
Vulnerability Fixed: 29 July, 2020 11:44 GMT