Lucene search

K
openbugbountyDevl00pOBB:1243727
HistoryJul 31, 2020 - 7:10 a.m.

409shop.com Cross Site Scripting vulnerability OBB-1243727

2020-07-3107:10:00
devl00p
www.openbugbounty.org
4

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: 409shop.com
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAV6ElEQVR4nO2dfUxT1xvH77BCLeVFKBWlDiQOCCMMCTLc2GLUKBJiqlOHrCq+RJlzSog6VOIYI+iQGUccccwtzBlnFuMIIYSRzrgGCfGlqbVjSNDUrnZMCwJWrFC5vz9Ofic39+X0UilFfT5/9Zx77nPOec659+k9997vfY2maQoAAAAAvICfrxsAAAAAvLRAjAEAAAC8BcQYAAAAwFtAjAEAAAC8BcQYAAAAwFtAjAEAAAC8xaSIMXPmzLlx44ZQEphIwPkAMCbgkCHj+xhz8+bN0dHRt956izcJTCTgfAAYE3DIuMVNjLl7925QUBDvpoGBgcOHDwslxdPQ0LBixQqh5ESyfPny7777Did7e3vXr18fERERFRW1f//+kZERlP/w4cP169eHh4dHRUV99tlnOJ8LwXuTE4LzJ7gvd+/enT59+vPU+8I5n4Vn7X/48OGmTZvQpEWTU8gO9jCBW7duLV++PCQkZMaMGVu2bBkYGKCEjwuKop4+fbpu3TpudX/++ee8efMCAwMXLFhw8+bN5+8mAY9PRJ4xvuerR48e7d69Ozo6etq0afHx8V999dWzZ8/Gy7iv8Pw6pr+/v6KiQigpnkkSY27duqXX6zds2IBzNmzYMDo6ajAYLl68eOnSpbKyMpS/efPm0dFRo9Go1Wp1Op1nvZ6c+DDACxEdHW23233diheG/Pz84eFhNGnb2toOHTr0PA7Mzs5WqVSdnZ16vd7pdBYUFFDCx8XTp0+zsrJcLhfXTm5ubmlpqdVqzcrK2rx5s8e9E4PHJyLPGN9DZvPmzRaLpaWlxWKx1NTUNDc36/X68TLuM2giZrNZLpeL2UQoScBms4WGhg4PD/MmJ5IdO3aUlJTgpMPh8PPz6+/vR8nW1ta4uDiapp1Op0QiYeYnJiYK2fTMJ76C7PwJ7ovZbA4NDX1OCy+Q87l40P6hoSGVSuVwOFDyypUrc+fOJdgne9jpdB4/fnxwcBAljUYjMs57XCCD5eXlvM1WKBRWq5Wm6cbGxuTkZFYzxneYJnLcx/d8NTQ0xDy3vDSIuo755ptv5syZEx4evn79enS9PDAwEBMT43A4XnvttZ9++omZPHbsWFBQ0NGjR2fMmDF9+vSNGzc+efJEyHJDQ8PSpUunTp3KSq5cufLo0aMo88aNGwEBAaheiqK2b9/+xhtvELbu3buXvPvevXtZzRgYGDh37tzOnTtxjt1ul8lkISEhKKlSqe7fv09RlNPpHB0d9ff3R/lSqXRoaIiiqKtXr7733ntBQUFRUVEffPDB33//TfAeRVGPHz/evn17RETE7Nmzv/jiC3RFjNYN3Lru2bNn+/fvnzFjRmBg4Jo1a3p7e8kGv/766zlz5gQGBn744Ye9vb179+6NiIgIDw/ftGnT48ePecdCqDu8feGtXWRfmNy7d2/ZsmVBQUHx8fFnz55Fmay1FG7DRFZ09erVBQsWTJs2LSIiYs2aNffu3aMo6ttvv122bBkuc/DgwY0bNzKdNn369I8++gj39OnTp1u2bAkKCoqOjv7888+Rk91ONsLccDvovA4X2mXatGn//PNPYGAgKtbd3T1r1iymA3k9LERAQMDu3bvRviMjI2fOnFm0aJHQcUFRVHR09MGDB3lN7dixIzs7+5NPPjlw4AC5Xt5pzDvhKb4xZZ2XhIZMiN9//53sE1YZ1iHDnWBibOICo6OjFEVJJBK3bXixcB9jHA6HwWBoa2u7cuWKzWYrLi6mKCokJKSzs1MulzudTo1Gw0yuXLnS4XBcuXLl2rVr165d0+v1lZWVQsaFFspycnK0Wi3KbGxsHB0dbW5uRkmtVqtWqwlbs7OzybtnZ2ezmnHq1KmcnJwZM2a49UZISEhqauqBAwdGRkYePXpUWlqalpaGGpyfn2+xWFpbWzMzM6VSKcF7FEXt2rXLZrPp9frm5uaGhoaamhpc3q3rKisrtVqtVqvt6uqaNWtWR0cH2aDBYGhtbTUYDDabLSEhwW63G43G9vZ2s9l84MAB3rHg7Y5QX4RqFz8NEDt37gwODu7o6GhqahI6Ewk1zG1Fer1+27ZtPT09JpNJpVKh/xNqtVqn0z169Ah7YNWqVcig0WhEPbVYLNhLZWVlQ0NDRqOxublZp9OdPHmScjdX0WzknRsYofYTHO62y7du3dqzZ09VVZUYD0dwYO7122+/yWSyK1eu1NbW8g6KW+Ry+Z07d+rq6pqbm998801CSd6JxDvhKb4xZZ2XKIEhE+pyfn7+4sWLr1+/ztu2q1evLl68OD8/H+cwDxneCUa2yTIYGBiYnZ2dm5t7+fJl5p+/Fx7yZY7ZbKYoCl8vt7W1xcbG4k28a2VoF4vFgvIvXLiQlpaGflsslpiYGLyLw+GQy+V9fX3cpM1mk8lkTqeTpun09PSioqK8vDxkPDg42GKxELYODw+Td+de28bGxhoMBubqAbd3eFNHR0dKSoq/v79MJqMoqqWlpa+vTyKRoOrEeM/lcqGjDuU3NDRkZGSQXcdEqVTq9XpmDtkgc2XDz89vaGgItwevpTCdz9sdwkzgrV1kX5hdkEqlzPLI4cyBIDSMWxFhzaS7uzsyMhL9zsjIOH/+PC7vdDpZPW1tbcU9VSgUeCXKYDCkp6fT7ubq/fv3eeeGmPYTDj2yb61Wa2xs7Llz55h+EPIwKs+CaW1oaEin0yUlJZ08eZJwXOAclttPnTqVnJzc09OzcOHCrKws5H+lUsktLzSNuROeCx5TVgN4h0yoyw6Ho6KiIiwsbO3atV1dXdhIV1fX2rVrw8LCKioqsDXW6Yu3MUI2eQ3SND04OFhcXBwXFyeRSObOnVtaWupyucgdn/yM7X4M+SyMY4xUKsX5HR0deD65XC6bzYY3XbhwYdGiRULJlJSUixcv9vT0qFSq/v5+pVLpcrlOnTq1atUqt1vFFODWKzLGIPr7+48dO4aP7dzc3JSUlKKioqqqqkuXLpGN2Gw2f39/nN/V1YUPDyHXMeuVSCSsmUcwSOgFM8lyPrc7BFO8tYvpC6sLrPLcGCPUMN6KWDvq9folS5bMmjVLoVCEhYXhxh85ciQ/P5+m6RMnTqxdu5bQ076+PoqiFP8nLCwM94g82XjnBtO+mPazJifZtxkZGdXV1bgwsiPkYZE0NTWlpqZ6EGNwhLDZbAqFoqKior29PSUlhVuedyLxTngE75iy/pQIDRmBvr4+tVotkUhwjkQiUavVrDslrENGaILx2uQ1yMTpdLa1tWVkZDBvEr+gTOj7MVOmTJk5cyZOkp8oy87O1mq1jY2NOTk5ISEhKSkpOp0Or3SRt4opgKmuri4sLBxrX2Qy2fHjxw8dOoSSv/zyC/q/Njw8XFRU9Omnn47V4JiYMmXK+BpkOX+CuyMejxumVqvff/99nU5nMBiamppw/qpVq1CysbERLZQJ4XQ6/fz8rl27ZjAYDAaD0Wg0GAxoE3myTbAz//33X6PROKZaeBeORkZGrl69isvExsbabLaxNubBgwd9fX3z5s2jKGrmzJl1dXWHDh2qrKzMzMwckx3eCS80phjCkAktD96+fXvnzp06nQ4/L0dRVFlZmU6n27Fjx+3bt3Em65AhNIZrk9cgk4CAgAULFlRXV//6669i/DOpIYcgz65jKMaFfH19Pe8iicvlUigU+LqYlaRpuq2tLT09fcWKFU1NTTRN19TU7Nq1KzIyEl0JkbeKKYChKCosLAz9+/Dz80N/eQjPzyBqa2tTU1N5nWYwGFQqFcF7ItfKhFynVCoNBgPLmUIGxVzHcJ3P7Q7BlJi1MqG+MLvAXMmpr6/nvY7hbRhvRcwd0YIVc0emH5KSkrRabWhoKFqYIvRULpfzLtqIn2x4bjDtu20/zTn0CL51uVzMoRRaK8MepgUWjtAjlHgtqKGhIT093e1xwWo2qpS57rRt2zaKokwmE7c8Ya2MNeFp4TFlNUBoyHi7XFBQIJfLi4qK7HY7q7zdbi8sLJTL5QUFBTTnkCFMMCGbLIMI5roZTdM6nQ4vkL64eB5jHA6HRCLBswcn0QGwevVqq9VqMplSUlJKS0uxBbwwjVZ4cT4riVAqlUqlEu1itVqDg4PxJbbbrW4L4JbgSdbe3h4cHIwnXFZWlkajsdlsXV1dmZmZzItWl8sVGxvb0NCAkh0dHVlZWRcvXrTb7RaLZevWrTk5OWTvbd26dcWKFRaLxWQypaamopUNguuYC/oVFRXp6elGo9FqtaL/RwSDYmIMy/m83SGb4tZOnga8qNVqZnnuKUOoYbwVDQ4OSiSSzs5OtMyiVCpramr6+/u7urrUajWz8YcOHUpOTkZDRnZaQUFBRkaGyWSy2WyVlZVlZWW4mNBkE5obeEyF2u82xhB8y5wtTDu8HiaQk5OTm5trtVoNBkNiYmJNTQ1NPC64zaZpeseOHe+8847JZLLb7XV1dQqFIjIyEu/FGibeacw74YXGlHVeIgwZF41GYzabCQXMZrNGo6H5zldCE4xsExukabqzs1OpVNbW1tpstv7+flRFRUUFoT0vBJ7HGJqmS0tLZTJZXV0dM/n111/L5fIjR44olcrQ0NANGzbgm8xMa3v27Dlw4AA2xUoi8vLyVq9ejZNpaWnMMuSt5AK8/45Zvbt//35eXl5YWNisWbOKi4uZTwqcPn2aeREzPDxcWloaFxfn7++vVCo1Gk1PTw/Zew6HY9u2bQqFQqVS4Tt7qDzXddz/hvv27VMoFFKpVK1Wo/9HBINCHcRJlvN5u0M2xa1dqC8ErFbr0qVL5XJ5XFxcVVUVN8YQGsZbUXFxMZ6fOp0uLS1NKpVGRkYWFRUxG4/WT/A0JvTU6XQWFhaqVCqZTJadnc28XBCabG7nhshB5y4hCPmWO8rYDq+HCdy/fz83Nzc0NFSlUpWXl+NMoeOC22zktOLi4piYGKlUmpqaeubMmTt37shkMhwqmMPEO415JzwtPKbM8xJhyJ4H7vmKMMHE09TUtHDhwuDgYJlMlpycXFtbOy6t9S1uYowHEBY3mMTFxbW3twslX01Eum7c8YbzJ6wvz1+Rw+GQSqW8DwhNAB6031fzBMDA+Uo8Pnvf59atW4QkMJG84s5vaWnJzMx0K94FAJhX/JAZE77XXfYVN27c+Pjjj33dCh8wMjKybt26//77T2T58ZUu5z7Pg8AvQk4wAwMD6Klln9QOAC89L5tugXjy8/Nzc3N93QofMHXqVH9//z179vz8889uC4+7dDl+eJSFrzSSlUplTk4OUwsVAIDxxLMlNvRkC0alUqG7f9wblbiMn59fTExMWVkZuo+H5FE9q9qzxWhmjXa73c/PDz/Y8/yr23a7XaPRKBQK5o1Q5t3RwsJCwsveTAYHByMjIzs7O1Gyr69Po9EgI/v27UOWhdrMzS8sLJRKpehBDJyp1+vxe8hkysvLd+7cSShQV1eXkJAglUoTEhLwe39CiHH1OM5SAAB8judrZUh4w+l0Dg0NNTU1IZVvrpA4LuZwOOrr6xsbG5Hy9gRLcLNqdDgcMpksICBgvIzzCp5v2LBBKpWaTCadTmc0GktKSsSYqq6u1mg08fHxKDmmTwmw/N/b21tdXd3e3r5y5UpmsbCwMIfDIaYxZOny77//vqSkpKqqymq1njx5srq6+ssvvxRjlgCaLZ2dnaGhoc7/85w2AQDwGZ6FJu4f0tbW1oSEBDHFkBi+x1cP47Ij64FOobcpRcL7Yhp6Wkmk0DpmcHAwKSkJq1QJfUpApBNwMVYfRe7uVrpcpVK1tLTgpF6vl8lkrPfIeNsjpuXPqe0PAMBkwP11jJCwNgupVOp0Ot1+1U4qlbpcLq4EN68CtpBcNhNe7W7UjMOHD0dERMycOfOHH37g1oiJiorCqqhuddp5q+MVPA8MDHzy5AkWWh8eHsZfBOAVMEecOHFiz5492IdCnxJAcIXfmf7v7e3FXdZqtUJqskxYo0BW+x8YGLBarQsXLsTl582bd+nSJfSbOwRMyx4o/4vRXQcAYLLhPsYICWszGRgYKC0t5UqBsXjw4EFJSYlareZKcPMqYAvJZTMR0u52OBydnZ0mk6muri4zM5NbIy9uddqFqnNLeXk5vrEspMP/+PHjY8eOlZWVRUVFHTx48NmzZ0KfEqCIwu+I8PBwMV1GcHXLKXdq/+hCDX/7BzF//nwcVllDwKpxrMr/ZN11AAAmKW6vdHiFtdHNfCxo6u/vn5eX53A4eO/5Y9FTqVRaUFDAe6ddSFUbMybtblQv6606obUyJm4/CiBUHVmMtrS0dMmSJfilZV5RJpqmq6qq0GvM3d3dSUlJ6BY691MCuINc4XchETkWzHwhmXExav+EhS/yEJjdqdNzfeh2hgAAMAlxE2OEhLXNZrNMJkPSXnV1dZGRkUICGLiYzWZj2uE9Q7EUsD3W7haSinEbY2iiTrvI6ljnx/r6+tjYWCyAIaTDT9N0XFwcPu02NDQwT7usTwkI1ehBjBGSGXer9m+1Wpla8YQquJlmd+r0QvdjuLrrAABMZkQ9V8YrrO3n5xcVFRUVFbVx40aFQnHq1CnefXGxmTNnkhXpuQrYz6Pd7TEEnXYPqvvrr78KCgouXLgQHh5OLvnw4cM7d+7Mnj0bJePi4phS6qxPCYwjQjLjbtX+0SrcyMgIc6/r16977xN+vLrrAABMatxGIV5hbda/1HPnzqlUKvQNQTH/o7mbuArYz6Pd/TzXMWSddt7qhATP+/r65s6de/bsWWZhobUyFMBwfn19PV5DozmfEhjH6xiaT2ZcjNo/TdMqlUqr1eJ8k8mEnytzex1DEZX/udcxBN11AAAmLe5jDK+wNvcMkpiYyPspVqFTOUuCm1cBm1cumyUGzqvdzVsvs0aLxUJY5yF8FEBIKpwreO5yuZYsWbJr1y4nA1SYV8Ccpmm1Wp2VlWU2m41GY2Ji4o8//ojyWZ8S4HZwrDGmu7ubuxLFlBkXo/ZP03Rtba1KpWpsbLTb7TqdLjExEavziokxBHV6boxxq7sOAMAkxH2M4RXW5p5Bzpw5ExMT093dLTLG0JxPA3ARkstmioHzancL1YtrdDqdrE8nMSF8FEBIKpwreM6SQqAoiizsT9O03W5HRl5//fUjR47gBrA+JcDt4FhjzPnz55OTk3n7jhCj9o824ff84+LimO/5u40xZOV/eD8GAF4OXqMF1Dteenbv3m0ymf744w9fN2Siefr0aUJCQklJyZYtW4TKxMfHnz59+u233/ZSG+7evZuUlOQrHUwAACaMVzfGjIyMGAyG+fPn+7ohPuDy5cvvvvuuDxsAMQYAXhFe3RgD+BCIMQDwivDqfj8GAAAA8DZwHQMAAAB4C7iOAQAAALwFxBgAAADAW0CMAQAAALwFxBgAAADAW0CMAQAAALwFxBgAAADAW0CMAQAAALwFxBgAAADAW0CMAQAAALwFxBgAAADAW0CMAQAAALwFxBgAAADAW0CMAQAAALwFxBgAAADAW0CMAQAAALzF/wBWIPleax2cdgAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQ5UlEQVR4nO2db0xT1xvHr1ihQCmgUAGrgDGVGKM4WQcLc8Q51K5pquCfsE5dRnRZkDCixrnMderEwVwyxpgx2cJ4sSXLRgghhphmMx0jhiFWLFgqYYBQWC0MsGBhpf29ONnN/d2ee3pbKH/0+by69/bc53yf5xx4es/tfe4yt9tNAQAAAEAACFpoAQAAAMAzC+QYAAAAIFBAjgEAAAACBeQYAAAAIFBAjgEAAAACBeQYAAAAIFBAjgGeBZKTk+/du7fQKgAAYAM5Bljy3L9/3+Vybd26daGFAADAxnuOWYYjIiJiHsTNJ2NjYyUlJX6f3tvbO+cxmaUkJu+//35oaOj333+PtR8I8Tzh07XXONTV1alUKr/tzyG9vb3R0dGz6XcBx2JOmI3+pe47gMV7jnE4HA6Hw2QyRUVFoW2z2TwPyuaZ0dHRy5cvL7SK/2OuJA0PD5eXl9++fVuj0QTC/mxITEy02WzkNl51EnLMQsHHL4AFBO2ZROC1RUhICEVRQqGQ3g4ODg60LGAOsdvtYWFhi3YpCU0qvxkcHDSbzVlZWXMkZ86YpV/PJxC0Zw//78d8+eWXycnJq1ateuutt8bGxujjU1NT77zzTkRERGJi4scffzwzM8M8C10Ol5WVrV69Ojo6+ujRo0+fPkUf/fnnnxkZGaGhobGxsQcOHBgYGECNS0pKYmNj4+Pjv/32W2wz2uzVq1eTk5PDw8MPHTo0PDx8+vTp2NjYVatWvf322xMTEwR5Y2NjSUlJdrt92bJlaEHJsxlWDBcTExMnTpyIjY1du3btJ598QgdhZmbmgw8+WL16dXh4+IEDB4aHh7k84iOJT6fDw8MsOwim/V9++cXvAUX6X3nllYiIiDVr1uTk5Dx48IDLU88Y0ssjXBPDMw4s6urqsrOzV6xYwaWEyzVsuAjzk4uBgYHdu3dHRERs3Ljxhx9+QAdZyz6ewnh2hJ0bX3/99e7du+k2H374YU5ODj3/o6Oj33zzTfII7tu3r6ysDH167969kJAQuv2JEydOnz5NCCbTQS792IB7ddlr0MgDASxO/MwxdrvdYDA0NTU1NzdbLJazZ8/SH124cGFycrKtra2hoUGv11+7ds3z3Obm5paWlpaWltbW1tLSUnS8tbX1+PHjQ0NDRqNRKpUWFBSgxiaTyWg0VlVVZWZmcjWjJTU2NhoMBovFkpKSYrPZ2trabt++3dPTc+7cOYK8yMhIk8kkEokcDgdaUMI28xTDRWFhocViaW1tbWhoqKurq6ysRMdLS0t1Op1OpzObzQkJCR0dHVwe8ZTktdNVq1ax7CCY9vft2zebAVUqlceOHevr62tsbMzMzESXvFhPyTHETgzPOLBgLpRhlXC5xjVGXPOTi4KCArFY3NHRcePGDTrH8AkRn46wc0OtVuv1+idPntAR2Lt3r91ub2trQ2729fXRE57CjaBSqdTpdOjT+vp6l8vV0NCAdnU6nUKh4NLsdbwIAfc1tl4FAEsDNz96enqioqLobYqixsfH0W5TU9P69evpljExMXa7HW0bDAa5XM6yQ1FUX18f2q2pqUlLS/PsrqurKy4uDjUeGRnhUoWa0WZHR0fR8cbGxqCgoMnJSVrhhg0byPJ6enpEIhHBC7IY5ulOp1MkEnV3d6Pdurq69PR0tC2RSFpbW7ncYXrERxLzREKnLDuemmczoCMjIwKBwOFwsIxjPfWMIUsDdmJw6Xe73Xa7XSQSIYNYJVyucYWL5/ykcTqdQqGQ2R79mTA1E4R5dkRwljk30tPTf/75Z7o9ukVKu9nY2EgeQYvFEhYWhiTJ5fLi4uK8vDxkTSwWT09Pcw0rH/1cc8lrbL0GDViKeL8fg0UkEtFXtQkJCSMjI2j7n3/+sdlsSUlJaNflcgkE7C6EQuHatWvRdkpKSl9fH9q+e/fumTNnOjo6pqenXS6Xy+VCHaEf6tBgm6GWkZGRaFsqlYrF4tDQUFohupfIRx6hmacYLFardXp6Ojk5mfYR/XWNjY2NjIxs2bKF1Z7LIz6SvHbKE78HNDo6Ojc3Nz09fefOnQkJCWlpaa+++iqXpxQxhlwTg8DNmzflcjkyiFXC5RohXD7JsFqtFEUx23u24RLGpyOuuaFWq+vr63Nycurr6xUKRXBwMNNNqVRKHsH4+HiZTNbU1LRp0yaLxXL+/HmZTDYzM6PT6Xbt2rVixQouzUy49HPNJZ9iy0cAsCTwM8dw4XA4goKCWlpa6P9EQUF8l+PUanV+fv61a9eEQmF/f/+ePXtm02w28rDNpqen+XdEYPny5awjfDyaTWBnA59+f/zxxzt37hiNRovFUlxc/PLLL1+6dInCeTrnsH5R5qnk1KlTgdbAB7+Fcc2N/fv3o5XG+vr6Y8eOESxwjaBCodDpdN3d3UqlMjIyMjU1Va/X0wtlWM1fffWVvwHwhwUXAMwNPK93WGtlzMt55kdut1skEhGWg1jXy7W1teh62Wq1CgQCupnBYIiKivJcN8A28yqJucslj2XBsxlhEcPty1qZwWDg4xEfSUxmuVbm94CyMBgMUqkU6ylWCddaGT0xCPqdTmdMTAztMlYJl2s818qYMrCw1spqa2uxExIrDNsR80TC3HC73Zs3b9bpdFFRUePj436MYFNTk1wuV6lUN27ccLvdlZWVhYWFcXFxFouFSzPzCB/9bo//G+TYeg0a9iNgkTP334U1Gs17773X3t4+ODhYVlZ28eJFzzbFxcUDAwPt7e1arVapVFIUFRsbu3Llym+++WZsbOzhw4darRZrnGczP+TFxMQ4HI6HDx/y94LJypUrHQ5HZ2fnzMzM8uXLDx8+XFRU9OjRI+RjXl4ealZUVHT8+PH79+8PDAycPHny999/J3jkkyRCp1yw7PsaMcSDBw/27t3722+/DQ8PP3r0qKKiIjU1FespuReE58Qg6GxqaoqLi6PXu7iUYCGHCyuDy86ePXuY7T3bEIR5dsScSOTZvn///uLi4szMTK/PLWJHMCMjo6en5/bt2zt37qQoSqVSVVVVxcXFxcfHEzRPTU0xLfMPlK+n+DSawKKGZy7ifx3jcDiKioqkUmlYWJhCoWB9zUTnXrlyRSKRREVFHTlyhL4zr9fr09LShEJhXFxccXEx9joG28yrJOYuQZ5Wqw0LC6uqqsI2I1/HuN3us2fP0qfb7fbjx4/HxMRIpVKtVut0OlEbp9N55syZmJgYoVCoVqttNhuXR3wksQRwdUpQjuxfvXrV7wGdnp7WarUymSw4OFgikWg0mqGhIS5PydcxXBODFQeaU6dOnTt3jqyEMDGw4SLLwNLf35+dnS0SiWQy2eeff+45IQnCsB0xJxJhbhgMBoqiUDP//iTz8vJyc3PpZmlpaXQ8vQaTSz/5OoYcW69BIw8EsDhZ5na75zOl9fb2bt68mf7ZJQAg/JgYGzdurK6ufumllxZWxkJ1NDExERMTY7FY+PwOZc7xQz/87T+fzPE9fwCYNzo7OxdawkJy8+bNzMzMBUkwAMAfyDEA4J3Y2Fjs8e7u7gUp4zg2NlZRUXH48OH57xoAfAJyDAB4B9388GSh6gRLJBKlUnnkyJEF6R0AfGAO7+14vSseuC786BpV8/XplKqqqpSUFKFQmJKSUl5e7tO5c8L4+HhhYeG6deuEQqFMJrty5QrzTjVq46tfXDZ5wjPyTFXzME8AAFgkPL85xtdTrl+/LpVK6+vrbTbbrVu3NmzYcOHCBZ96nD25ublqtdpkMlmtVp1Ol5WV1dzcjD6iq2746hfBJk/4FPxgqYIaIQDwnDCXvyubh9+NcHUxD79yWbt27Xfffff666+j3bt372ZmZlqt1vDwcP6dzoanT5+KxWKbzUaXzMHik188bc4e+E0RADyfeHkG89ChQ59++im9m5GR8cUXXzDXoOkX/7FgFttnFRvH1ornX8afoqjPPvvMa+l1ckV6z4rxXNX46fb9/f3Ml5Rs27bt1q1bXMq5rGHLlfOsYY5qVWELrNFF0X19IwDBJoWrz08ozk/xrs/PquePnSSDg4NvvPFGREREcnLy1atX4ddTALBE8ZJjDh48WFtbi7YHBwcNBkN2djZP01zFxrlqxfMs42+321v+g1AenFyR3rNiPFeld1qbUChELymhefHFF9FFjKdyLmvYcuU8a5iHh4crFIrDhw//8ccf9OtwWPj6RgCyTWx9fvILDnytz881SQoKCoKDg7u6unQ6XXV1NdZZAACWAOSltMnJSbFYjEoMVVZWqlQqr8/x0tsUR7FxbK14nmX8+VdEJ1ekZ51CKPbl2djTDks5lzVsuXKfapiPj4+fPXtWJpMJBIINGzawnk7HSvUaBy6bblx9fkJxfvpTr/X5ud4pQE8SVASMDiBdMB8AgCWHl98uh4aGKhSK2trakydP1tTUkCu8ssAWGyfUiudZxp9PeXCeNfxpvBbGFwgETqeT4ClTOZc1bLlyQg1z5jMZjx8/pigKrVOVlJRMTU21trYWFxc7nU5CLTU+ceCyyVWfn/yCA1/r82MnidVqdblczACSjQAAsGjx/nzMwYMHKyoqNBpNc3NzTU0N820QfuBTjXq/y/jPeSV8tM7z77//MpfL7ty54+u/P2y5cq4a5lzPZFAUFRISkpGRUV5ertFoCDnGpzhgbc5DfX4AAJ5hvOcYhUKRn59fXV29a9cu9JVzcnLyyZMnaLu/v9+n/uLj48PCwkZGRrZt20Zu+fjxY4vF8tFHH6Fd9JIxiqIcDsejR4/Ql2Wz2bxu3brZ9IKQSCTBwcF//fUX+u5sMpno7/6IyMhIqVSq1+tfe+01dKS9vX3Hjh3oFVU+Wdu+ffv27dspilIoFEqlEqUT7ME1a9awLE9MTDB/xuZwOAhXVzzjwGUzMjJy5cqV9+7d27p1K6ELFnxGxysSiSQoKKi3tzcxMZGiKJPJ5IcRAAAWBXwW1PLy8sRi8U8//YR25XJ5fn7+0NCQ2WzOzMyk18rHx8cFAoHJZHI6nYTbNu+++256ejr62l5aWoqeMsHe8JBIJJWVlaOjo2azWa1Wo0rMFEXl5ub29/cbjcbU1FStVsvqmtALE7vdLhAIzGYz2s3Pz1epVH19fUaj8YUXXvB8xJL5fIxer9+0adOlS5e4lGOtdXR07Nmz59dff7XZbH19ffn5+UqlEnsQOwomk0kikVy/ft1isYyOjur1+s2bN6MHG5kaWH6R40Cw6Xa7L1++LJfL29ra+vv7CwoK9Ho9oXCy+7/7K56jw1LF57016Kmdnp4eo9G4ZcsWuB8DAEsUXjmmtrZWJBLRhbi7urp27twpEok2bdpUXl7O/Puny5IT/n1gK43zLOOPmpWWlpIronP1woJZMZ6rMD4T+jl/mUxGJyGscqw1bLlyn2qY37hxIysrSywWh4WFbdmy5fr161gNPr0RgMumG1ef32uO4VOfn0+OGRoaUiqVIpEoKSnpypUrkGMAYIky37X9gWeYAD1o2dnZuWPHjr///ntuzQIAMA/MxzvhAWA2GAyG9evXL7QKAAD8AeouA4uRixcvJiQkqFSq7u7uc+fOnT9/fqEVAQDgD3AdAyxGsrKyKisrpVKpRqMpLCw8evToQisCAMAf4H4MAAAAECjgOgYAAAAIFJBjAAAAgEABOQYAAAAIFJBjAAAAgEABOQYAAAAIFJBjAAAAgEABOQYAAAAIFJBjAAAAgEABOQYAAAAIFJBjAAAAgEABOQYAAAAIFJBjAAAAgEABOQYAAAAIFJBjAAAAgEABOQYAAAAIFP8DVbT0uzMmvzgAAAAASUVORK5CYII=)

Screenshot: 409shop.com  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 31 July, 2020 07:10 GMT
Vulnerability Verified: 31 July, 2020 07:23 GMT
Website Operator Notified: 31 July, 2020 07:23 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 31 July, 2020 07:23 GMT
Vulnerability Fixed: 20 August, 2020 03:17 GMT