tnt.com Cross Site Scripting vulnerability OBB-1256860

2020-08-1117:08:00

raviakp1004

www.openbugbounty.org

JSON

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	tnt.com
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	raviakp1004
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAARwklEQVR4nO2df0xT1/vH75DWUgqV0lakOH64ISHGEcI63Vjm1DhDGKkTcWO4oRJE4xwh6JRsysiGRtE5NMQsc2GGbGZxhjBjnOlY0jjmFLF2pMOGaa21Miy/tGKF2vv943x3cz/3nnt6KxSYPq+/em6f85znvO+5fbjn0qfP0DRNAQAAAEAICJvsAAAAAIAnFsgxAAAAQKiAHAMAAACECsgxAAAAQKiAHAMAAACECsgxAAAAQKiYujkmOTn5ypUrQk3gSRJkjHMJhRRPkrwAMIlM0Rzz559/+v3+F154AdsEniRBxjiXUEjxJMkLAJNLgBxz48aNqKgo7FtDQ0O7d+8Wao6RlpaWvLw8oebEIHJG4ztxkUyKIOIJSpMxzoXQnbN6xUc1KfISrrWJGS6osyb+k+ExvA0MDKxdu1aj0eh0uo8++mh0dDQob+Qhbty4ERMTM3aHgFhoIna7XaFQiHmLYPkY6PX6s2fPCjUnBpEzGt+Ji2RSBBFPUJqMcS7k7l6v9zGimsrrLXTDBRWA+E+Gx/CWl5dXWFjodDq7urqys7O3b98elDfyEHa7fcaMGWN3CIhkKu6V3b5922azLVq0CNsEniRBxjiXgN2nT58+wSEBY+TBgwcdHR1fffWVTqebO3fugQMHTpw4MXa34eHhqamp7BfAxCAqx3z55ZfJycmxsbFr1qwZGhqiKGpoaCgpKcnj8TzzzDPffvstu3ngwIGoqKh9+/bNnDkzJibm/ffff/DgAfJz8eLFV199NSoqSqfTrVy58q+//sIO19LSsmzZMolEwmmuWLFi37596OCVK1emT5+OgqEoasOGDVu3biUbPP/88+Tu7Bg4E0Q32vv3709OTo6JiXn33XexOrA9PHr0aMeOHTNnzoyMjFy1alVfXx86fv/+/Q0bNmg0mtmzZ3/66aePHj2i/r2RR/4jIyNXr17d19e3detWjUYTGxu7du3a+/fvY/XBjkIYYvfu3RqNZtasWUePHkVHsGdKpAd0ThcuXBgREaHRaFatWnXr1i2+Jg8fPly/fn1UVFRiYuKuXbuQN/5csGZCyvO781cXewdGfFSc5YddtEJ9+WpgRRNaGxTuWsN6IARAEIES3ini6CPyUg34yRDUwkZERETcvHkzMjISNbu7u+Pj4ymKunXr1htvvBEZGTlnzpwvvviCsN91/fr1yMjIy5cvUxTV19cXExPz66+/6nS6S5cuURSl0+n++OMPxvjnn38W8sMxwGqyevXqzz//nDFeuHAh53MACJxjPB6P2Wxua2u7cOGCy+Xavn07RVFKpbKrq0uhUHi93qKiInZzxYoVHo/nwoUL7e3t7e3tHR0de/fuRa5yc3OLi4sdDse5c+eys7NlMhl2RKGHMbm5uUajER08deqU3+8/c+YMahqNxpycHLKBwWAgd2fHwJkg0sFisSAdHA5HVVUV1oxh7969RqPRaDTabLb4+Hir1YqOb9myxeVydXR0nDlzpqWlpaGhga3zuXPnzGazy+VKS0tzu90Wi+X8+fN2ux0Nx9cHOwphiK6urs7OzsbGxuzsbHQEe6bEe+jo6CgtLe3p6ens7ExISNi8eTNfk5qamuHhYYvFcubMGZPJdOTIEexchMywyvO7k1eX+Kg4yw/rVqgvXw2saEJrA3utYT0IBSDyEuPD0UeMHzGfDFQwC5vP1atXKysr6+rqKIravHlzdHR0V1fX2bNnGxsbGRsNj+Tk5KqqqvLycoqidu7cmZOT8/rrrwsNUVxcvGTJEpR+OFy8eHHJkiXFxcWoidWkoKCgubkZGdy+fdtsNhsMBqLSTx/krTS73U5R1N27d1Gzra0tJSWFeQv7PAZ1cTgc6PjJkyezsrJomu7v7w8PD2fvjzM4HI6kpCT02uPxKBSK/v5+ftPlcsnlcuRBr9dXVFQUFhaiEaOjo0dGRsgGDoeD3J0/d2aCHB3OnTsnpAODVqvt6OjgHPT5fAqF4tq1a6jZ0tKyYMECxv/g4CDjPywsbHh4mJH9ueeew+rDH4U8BNORFj5T4j1w6O7ujouL42uiVqs9Hg96bTab9Xo9di5YM4Ly7O7Y1UV+ZIgdjhOS0KIVmhFfDaxo2LUhdK1hPWADECkCehpBeB5DuFQDRkvjLpyACxt7ETmdzpSUlOPHj9M07fP5ZDIZe60yz1ScPGiaHhkZSUtLq66uVqvVPT09hIl4PJ7a2lqVSlVQUGCz2dBBm81WUFCgUqlqa2uRzkKaDA8Po88WmqYbGhry8vIIYz2dhAdMQgqFgrnXjo+P7+/vD9hFJpPNnj0bvU5LS3M4HBRFxcTE5OfnL1iwYPHixfHx8VlZWa+99hrjtq2tDb0+e/asXq9nboTZzVmzZqWmpra1taWnp7tcrp07d6ampj569MhoNC5dulQikZANZs+eTe4uXoeEhASyDkNDQ/39/fPnz+cc7+3tHRkZSU5OZsRBFyHyr1QqGf/R0dERERGMPm63my8IdhTyEJwdBuyZCsrD5cuXt23bZrVaR0ZG/H6/3+/nTHlgYMDtdiclJaGm3+8PDw/nz4VgJqQ8uzthdWERGo6z/LBuCaFi1eCIJrQ2KOFrjeNBKIBgRRBCpB+RnwwiFzaf/Pz88vLy1atXUxTV29tLURR7rTJmOp2O31cikRw+fHjp0qX19fUzZ84kTDYyMnLHjh1lZWXr1q1LT09H/8OWnp6em5t77do1JnIhTSIiInJycpqbmz/44IOTJ08yNz0AQ+AcM458//33ly5d6uzsdLlcFRUVL7/88qFDhyiKmjZt2qxZs5AN+b+Wc3JyjEbjtWvXcnNzlUplRkaGyWRi73SRDQJ2H1+mTZs27j75/1YbilHEYzAYSkpKjhw5IpPJnE7n8uXLOQZerzcsLKy9vZ35IA4L+/8dWvZcCGZCcKTgr67KykqhvkLD8eXlu62qqhIKNaAaDGM5awStghKBgNClOmHcvn3bYrH8/vvvAS01Gg3nyJ07dyiK6unpCQsL6+npCejh77//3rlzp8lkqqmpQUdqamrq6uo2bdpUU1MzZ84cdFBIk4KCgsOHDxcVFV24cOHkyZNBTfOpgHybI3SjjX0Lu1fW3NyMdmA4mM3mhIQEzkGfz6dWq5ldGk6Tpum2tja9Xp+Xl3f69GmaphsaGrZs2RIXF+dyucQYBOwuNHfxOjBotVqz2cyfoNA2lJB/dpMvCH8UkUPQwmdKvIfe3t7w8HCmaTabsfswCoUCu23ImQvWTEgZfnc2aHWR98r4w5F90qxFiw0VqwZ2eWDXhvhNLaEAsNHevXs3LCyMvdkYcK9MaNZioqVFXzjkOfp8PvaJ4OyVNTc3k/fKBgcH4+Lijh8/rlKprFYrQaWysjKFQlFRUeF2u9nH3W53eXm5QqEoKysja+L1elUq1cGDB9966y3CQE8tj59jPB5PeHg4s4PJNNEnV35+vtPp7OzszMjIqK6upmnaarUuX768tbXV7XY7HI6SkpLc3FzGM9roNJlM8+bNYw5ymgitVqvVapG90+mMjo7OyMgQb0B+l73fyp6geB0YD7W1tXq93mKxOJ3OzZs3m0wmdLykpCQvL8/hcHR2dmZmZtbX15P9s5t8QbCjiBmC/jfH8M+UeA9Iz4aGhsHBQZvNZjAYUJwcTcrKyhYsWID+ANy7d29NTQ12LlgzIWU43bGri9M3YFT8kIQWLTZUrBpY0bBnLagcgw1AKFq9Xl9SUtLT02Oz2bKzs5Hbu3fvhoeHd3V1+Xw+jj6ES5VZ3iKvCJELmx8M/b8XI03TBoOBvVbJ33HZtGlTQUEBTdOfffbZokWLCJZFRUV2u13oXbvdXlRURAf6+CosLIyOjv7hhx8IAz21PH6OoWm6urpaLpc3Njaym/v371coFHv27NFqtTNmzHjvvffQI76RkZHq6urU1FSpVKrVaouKiphnccwolZWVVVVVjH9OE1FYWJifn880s7KyODZkA8K7/IuZmaBIHdhmPp9v27ZtarVaJpMZDAbmrySPx1NaWqpWqxMSEqqrq9FFJfJS5AuCHUXMEMwR/pkS74GmaZPJlJWVJZPJ4uLiKioqmLDZa8Pr9ZaXlyckJMjl8pycHPT3KX8uWDMhZTjdsauLcEKxw/FDElq02FCxamBFw561oHIMNgChaLu7uxcvXqxQKNLT0+vr65lztH37dvb1y+hz9OhRrB/xNygiLxx2kxMM/5uSTqdz2bJlcrk8JSWlrq6OkGPa29sVCgW66fF6vUlJSceOHRMyFgnh44um6ebmZoVCwVw+AJsAOeYxeIxv+TKkpqaeP39eqAmMryBjOVNjZ4xzCcXagPX2XwG+q/8fYkKf+Qfk6tWrhCbwJAkyxrmEQoonSV4AmCJMxVoyTwlXrlzZuHEjwWB0dPSdd975559/JiwkAACA8QVyzKRRXFzMfMUBi0QikUqlj/e/pwAAAFMBUTnm0KFDqNzQSy+99Msvv5CNExMT7927R7YJRRnz/0TJbqbseV9fn8ViQeUuEAMDA2vWrImNjWXXMy8vL2fq34w7Ys4UAExBEhMTBwYGJjsKQBSBc8yhQ4cOHjz4zTffOByObdu2vf3227/99tsERPZEMjg4WFtbS1GUx+ORy+XsqsDr1q3z+/0Wi8VoNJpMJmSmUqk8Hs+khQsAADA2Aj/z37NnT1NTEyoqt3LlSrfbvWfPnp9++in0sT1FPHz48NSpU263W6lU6nS6urq60tLSXbt2TXZcAAAAYyLAfczQ0JDL5UKlXhHr1q07fPgwxyxgvXp+VXYhsK4oXNV06t9y31FRUXPnzv3uu+/InoVK2WNrp/PDEF+lXGggdtnzH3/8kR2b1+v1+/1SqRQ1ZTLZ8PAwfwoB65ADAABMKQLkGI/HI5PJ2PUiJRJJYmIix4xQCl6oKrsQQq6wVdNRuW+r1Xr69Gl2juGX+2biwZay59dOx4Yhvko5diDOLyCwZ61UKjMzM6uqqkZHR+/du1ddXZ2VlcUXh1CHHAAAYCpC/voM+2t6lZWVarVarVYzRbwR5FLwQdXDF3LFAVVND7bct1Ape37tdGwY4svvCw3EnjhfAavVmpGRIZVK5XI5RVHot3751VD4dcgBAACmLAFyjNPplMlk6PXg4KDT6Tx//jznG7Yul0sqlTJNm82G/RERMXUkhVzRNN3R0bF06dL4+Hi1Wq1SqWbMmOFyuZjYaJq2Wq3kr/7a7XaOvVarxQaDDUN8VQyhgWhijkEMDg4eOHCAn5PY9Pf3GwwGdvlFAACAqUmAZ/5oY2d0dFQikSiVSqVS2dvbi/7QnmDEV02nhMt9T33kcvnBgwf5T7wY+HXIAQAApiwBcoxSqUQ/IMb8SFFrayvn55W0Wq1UKr1+/Tr6Vauuri7yVwsJCLm6c+eOy+X65JNPkBn6XSOtVktR1M2bN9EvF9lsNsaP2WzG+vd6vWz7Z599NqgwxCNyID6NjY1qtfrNN9/Evrtx48ampqbS0lKbzRYbGxtUSAAAAJNAwDud+vr6lJSU1tbW3t7epqYmlUrV1tbGsQm2Xj16y/u/oOK+WFe0QA35oMp9C5Wyx+5H8cMIaq8MOxDNKnvucDjY+2kIn8+XkpLS0tLCHOnu7maPQq5DDgAAMNUQVXe5vr4+KSlJKpVmZma2trbyDYKtV8/8di+bI0eOCLmiBWrIo3LfCoUiNTWVXO6biYdfyh6bY/hhBJVjhGrm0/+WPf/6669lMhnnuf2xY8cyMzPZR06cODF//nzCpAAAAKYyz9A0PaH3TZPHjRs35s2bNwHVU0QO9OGHH3Z2dhJq8zx8+DAtLe3jjz9ev379eMcIAAAwEUyt2v5PFXV1dULPjRDTp09vamp65ZVXJiwkAACA8QXqLk8aEonkxRdfJNtAggEA4D8N5BgAAAAgVDxFz2MAAACACQbuYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQ8X+Ggnjji7WW3wAAAABJRU5ErkJggg==)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAARwklEQVR4nO2df0xT1/vH75DWUgqV0lakOH64ISHGEcI63Vjm1DhDGKkTcWO4oRJE4xwh6JRsysiGRtE5NMQsc2GGbGZxhjBjnOlY0jjmFLF2pMOGaa21Miy/tGKF2vv943x3cz/3nnt6KxSYPq+/em6f85znvO+5fbjn0qfP0DRNAQAAAEAICJvsAAAAAIAnFsgxAAAAQKiAHAMAAACECsgxAAAAQKiAHAMAAACECsgxAAAAQKiYujkmOTn5ypUrQk3gSRJkjHMJhRRPkrwAMIlM0Rzz559/+v3+F154AdsEniRBxjiXUEjxJMkLAJNLgBxz48aNqKgo7FtDQ0O7d+8Wao6RlpaWvLw8oebEIHJG4ztxkUyKIOIJSpMxzoXQnbN6xUc1KfISrrWJGS6osyb+k+ExvA0MDKxdu1aj0eh0uo8++mh0dDQob+Qhbty4ERMTM3aHgFhoIna7XaFQiHmLYPkY6PX6s2fPCjUnBpEzGt+Ji2RSBBFPUJqMcS7k7l6v9zGimsrrLXTDBRWA+E+Gx/CWl5dXWFjodDq7urqys7O3b98elDfyEHa7fcaMGWN3CIhkKu6V3b5922azLVq0CNsEniRBxjiXgN2nT58+wSEBY+TBgwcdHR1fffWVTqebO3fugQMHTpw4MXa34eHhqamp7BfAxCAqx3z55ZfJycmxsbFr1qwZGhqiKGpoaCgpKcnj8TzzzDPffvstu3ngwIGoqKh9+/bNnDkzJibm/ffff/DgAfJz8eLFV199NSoqSqfTrVy58q+//sIO19LSsmzZMolEwmmuWLFi37596OCVK1emT5+OgqEoasOGDVu3biUbPP/88+Tu7Bg4E0Q32vv3709OTo6JiXn33XexOrA9PHr0aMeOHTNnzoyMjFy1alVfXx86fv/+/Q0bNmg0mtmzZ3/66aePHj2i/r2RR/4jIyNXr17d19e3detWjUYTGxu7du3a+/fvY/XBjkIYYvfu3RqNZtasWUePHkVHsGdKpAd0ThcuXBgREaHRaFatWnXr1i2+Jg8fPly/fn1UVFRiYuKuXbuQN/5csGZCyvO781cXewdGfFSc5YddtEJ9+WpgRRNaGxTuWsN6IARAEIES3ini6CPyUg34yRDUwkZERETcvHkzMjISNbu7u+Pj4ymKunXr1htvvBEZGTlnzpwvvviCsN91/fr1yMjIy5cvUxTV19cXExPz66+/6nS6S5cuURSl0+n++OMPxvjnn38W8sMxwGqyevXqzz//nDFeuHAh53MACJxjPB6P2Wxua2u7cOGCy+Xavn07RVFKpbKrq0uhUHi93qKiInZzxYoVHo/nwoUL7e3t7e3tHR0de/fuRa5yc3OLi4sdDse5c+eys7NlMhl2RKGHMbm5uUajER08deqU3+8/c+YMahqNxpycHLKBwWAgd2fHwJkg0sFisSAdHA5HVVUV1oxh7969RqPRaDTabLb4+Hir1YqOb9myxeVydXR0nDlzpqWlpaGhga3zuXPnzGazy+VKS0tzu90Wi+X8+fN2ux0Nx9cHOwphiK6urs7OzsbGxuzsbHQEe6bEe+jo6CgtLe3p6ens7ExISNi8eTNfk5qamuHhYYvFcubMGZPJdOTIEexchMywyvO7k1eX+Kg4yw/rVqgvXw2saEJrA3utYT0IBSDyEuPD0UeMHzGfDFQwC5vP1atXKysr6+rqKIravHlzdHR0V1fX2bNnGxsbGRsNj+Tk5KqqqvLycoqidu7cmZOT8/rrrwsNUVxcvGTJEpR+OFy8eHHJkiXFxcWoidWkoKCgubkZGdy+fdtsNhsMBqLSTx/krTS73U5R1N27d1Gzra0tJSWFeQv7PAZ1cTgc6PjJkyezsrJomu7v7w8PD2fvjzM4HI6kpCT02uPxKBSK/v5+ftPlcsnlcuRBr9dXVFQUFhaiEaOjo0dGRsgGDoeD3J0/d2aCHB3OnTsnpAODVqvt6OjgHPT5fAqF4tq1a6jZ0tKyYMECxv/g4CDjPywsbHh4mJH9ueeew+rDH4U8BNORFj5T4j1w6O7ujouL42uiVqs9Hg96bTab9Xo9di5YM4Ly7O7Y1UV+ZIgdjhOS0KIVmhFfDaxo2LUhdK1hPWADECkCehpBeB5DuFQDRkvjLpyACxt7ETmdzpSUlOPHj9M07fP5ZDIZe60yz1ScPGiaHhkZSUtLq66uVqvVPT09hIl4PJ7a2lqVSlVQUGCz2dBBm81WUFCgUqlqa2uRzkKaDA8Po88WmqYbGhry8vIIYz2dhAdMQgqFgrnXjo+P7+/vD9hFJpPNnj0bvU5LS3M4HBRFxcTE5OfnL1iwYPHixfHx8VlZWa+99hrjtq2tDb0+e/asXq9nboTZzVmzZqWmpra1taWnp7tcrp07d6ampj569MhoNC5dulQikZANZs+eTe4uXoeEhASyDkNDQ/39/fPnz+cc7+3tHRkZSU5OZsRBFyHyr1QqGf/R0dERERGMPm63my8IdhTyEJwdBuyZCsrD5cuXt23bZrVaR0ZG/H6/3+/nTHlgYMDtdiclJaGm3+8PDw/nz4VgJqQ8uzthdWERGo6z/LBuCaFi1eCIJrQ2KOFrjeNBKIBgRRBCpB+RnwwiFzaf/Pz88vLy1atXUxTV29tLURR7rTJmOp2O31cikRw+fHjp0qX19fUzZ84kTDYyMnLHjh1lZWXr1q1LT09H/8OWnp6em5t77do1JnIhTSIiInJycpqbmz/44IOTJ08yNz0AQ+AcM458//33ly5d6uzsdLlcFRUVL7/88qFDhyiKmjZt2qxZs5AN+b+Wc3JyjEbjtWvXcnNzlUplRkaGyWRi73SRDQJ2H1+mTZs27j75/1YbilHEYzAYSkpKjhw5IpPJnE7n8uXLOQZerzcsLKy9vZ35IA4L+/8dWvZcCGZCcKTgr67KykqhvkLD8eXlu62qqhIKNaAaDGM5awStghKBgNClOmHcvn3bYrH8/vvvAS01Gg3nyJ07dyiK6unpCQsL6+npCejh77//3rlzp8lkqqmpQUdqamrq6uo2bdpUU1MzZ84cdFBIk4KCgsOHDxcVFV24cOHkyZNBTfOpgHybI3SjjX0Lu1fW3NyMdmA4mM3mhIQEzkGfz6dWq5ldGk6Tpum2tja9Xp+Xl3f69GmaphsaGrZs2RIXF+dyucQYBOwuNHfxOjBotVqz2cyfoNA2lJB/dpMvCH8UkUPQwmdKvIfe3t7w8HCmaTabsfswCoUCu23ImQvWTEgZfnc2aHWR98r4w5F90qxFiw0VqwZ2eWDXhvhNLaEAsNHevXs3LCyMvdkYcK9MaNZioqVFXzjkOfp8PvaJ4OyVNTc3k/fKBgcH4+Lijh8/rlKprFYrQaWysjKFQlFRUeF2u9nH3W53eXm5QqEoKysja+L1elUq1cGDB9966y3CQE8tj59jPB5PeHg4s4PJNNEnV35+vtPp7OzszMjIqK6upmnaarUuX768tbXV7XY7HI6SkpLc3FzGM9roNJlM8+bNYw5ymgitVqvVapG90+mMjo7OyMgQb0B+l73fyp6geB0YD7W1tXq93mKxOJ3OzZs3m0wmdLykpCQvL8/hcHR2dmZmZtbX15P9s5t8QbCjiBmC/jfH8M+UeA9Iz4aGhsHBQZvNZjAYUJwcTcrKyhYsWID+ANy7d29NTQ12LlgzIWU43bGri9M3YFT8kIQWLTZUrBpY0bBnLagcgw1AKFq9Xl9SUtLT02Oz2bKzs5Hbu3fvhoeHd3V1+Xw+jj6ES5VZ3iKvCJELmx8M/b8XI03TBoOBvVbJ33HZtGlTQUEBTdOfffbZokWLCJZFRUV2u13oXbvdXlRURAf6+CosLIyOjv7hhx8IAz21PH6OoWm6urpaLpc3Njaym/v371coFHv27NFqtTNmzHjvvffQI76RkZHq6urU1FSpVKrVaouKiphnccwolZWVVVVVjH9OE1FYWJifn880s7KyODZkA8K7/IuZmaBIHdhmPp9v27ZtarVaJpMZDAbmrySPx1NaWqpWqxMSEqqrq9FFJfJS5AuCHUXMEMwR/pkS74GmaZPJlJWVJZPJ4uLiKioqmLDZa8Pr9ZaXlyckJMjl8pycHPT3KX8uWDMhZTjdsauLcEKxw/FDElq02FCxamBFw561oHIMNgChaLu7uxcvXqxQKNLT0+vr65lztH37dvb1y+hz9OhRrB/xNygiLxx2kxMM/5uSTqdz2bJlcrk8JSWlrq6OkGPa29sVCgW66fF6vUlJSceOHRMyFgnh44um6ebmZoVCwVw+AJsAOeYxeIxv+TKkpqaeP39eqAmMryBjOVNjZ4xzCcXagPX2XwG+q/8fYkKf+Qfk6tWrhCbwJAkyxrmEQoonSV4AmCJMxVoyTwlXrlzZuHEjwWB0dPSdd975559/JiwkAACA8QVyzKRRXFzMfMUBi0QikUqlj/e/pwAAAFMBUTnm0KFDqNzQSy+99Msvv5CNExMT7927R7YJRRnz/0TJbqbseV9fn8ViQeUuEAMDA2vWrImNjWXXMy8vL2fq34w7Ys4UAExBEhMTBwYGJjsKQBSBc8yhQ4cOHjz4zTffOByObdu2vf3227/99tsERPZEMjg4WFtbS1GUx+ORy+XsqsDr1q3z+/0Wi8VoNJpMJmSmUqk8Hs+khQsAADA2Aj/z37NnT1NTEyoqt3LlSrfbvWfPnp9++in0sT1FPHz48NSpU263W6lU6nS6urq60tLSXbt2TXZcAAAAYyLAfczQ0JDL5UKlXhHr1q07fPgwxyxgvXp+VXYhsK4oXNV06t9y31FRUXPnzv3uu+/InoVK2WNrp/PDEF+lXGggdtnzH3/8kR2b1+v1+/1SqRQ1ZTLZ8PAwfwoB65ADAABMKQLkGI/HI5PJ2PUiJRJJYmIix4xQCl6oKrsQQq6wVdNRuW+r1Xr69Gl2juGX+2biwZay59dOx4Yhvko5diDOLyCwZ61UKjMzM6uqqkZHR+/du1ddXZ2VlcUXh1CHHAAAYCpC/voM+2t6lZWVarVarVYzRbwR5FLwQdXDF3LFAVVND7bct1Ape37tdGwY4svvCw3EnjhfAavVmpGRIZVK5XI5RVHot3751VD4dcgBAACmLAFyjNPplMlk6PXg4KDT6Tx//jznG7Yul0sqlTJNm82G/RERMXUkhVzRNN3R0bF06dL4+Hi1Wq1SqWbMmOFyuZjYaJq2Wq3kr/7a7XaOvVarxQaDDUN8VQyhgWhijkEMDg4eOHCAn5PY9Pf3GwwGdvlFAACAqUmAZ/5oY2d0dFQikSiVSqVS2dvbi/7QnmDEV02nhMt9T33kcvnBgwf5T7wY+HXIAQAApiwBcoxSqUQ/IMb8SFFrayvn55W0Wq1UKr1+/Tr6Vauuri7yVwsJCLm6c+eOy+X65JNPkBn6XSOtVktR1M2bN9EvF9lsNsaP2WzG+vd6vWz7Z599NqgwxCNyID6NjY1qtfrNN9/Evrtx48ampqbS0lKbzRYbGxtUSAAAAJNAwDud+vr6lJSU1tbW3t7epqYmlUrV1tbGsQm2Xj16y/u/oOK+WFe0QA35oMp9C5Wyx+5H8cMIaq8MOxDNKnvucDjY+2kIn8+XkpLS0tLCHOnu7maPQq5DDgAAMNUQVXe5vr4+KSlJKpVmZma2trbyDYKtV8/8di+bI0eOCLmiBWrIo3LfCoUiNTWVXO6biYdfyh6bY/hhBJVjhGrm0/+WPf/6669lMhnnuf2xY8cyMzPZR06cODF//nzCpAAAAKYyz9A0PaH3TZPHjRs35s2bNwHVU0QO9OGHH3Z2dhJq8zx8+DAtLe3jjz9ev379eMcIAAAwEUyt2v5PFXV1dULPjRDTp09vamp65ZVXJiwkAACA8QXqLk8aEonkxRdfJNtAggEA4D8N5BgAAAAgVDxFz2MAAACACQbuYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQATkGAAAACBWQYwAAAIBQ8X+Ggnjji7WW3wAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAXmUlEQVR4nO2dfUxT1xvHr5VBwRYF28pL/QnOoWOMMSQEF+aI2QvrGlLxdYxNlxFcDDJCJlF0jOmmTHHZHGNucYszy2aMMmIMIUvnDCPEMcbuEN/QOMBaEBGtIisV2t8fJzu56z333HtLL6B7Pn+1p+ee8zzPee49vee23zPF4/EwAAAAAKAAqok2AAAAAHhggTkGAAAAUAqYYwAAAAClgDkGAAAAUAqYYwAAAAClgDkGAAAAUAqYYwAAAAClgDkGAAAAUIpJMcc4HI6dO3ei111dXVqt1o+N+71Bib10dXWFhYXh11M4zJ49e/Pmzffu3RsfC7mW+B3u2HF7HIeYCzGxvY8nio6sbxDzAfgvMynmmFu3bu3YsWOirVAWjUbjdDqdTufQ0FBdXd3Jkye3bds20Ub5AeLYzZkzp7+/f0LsASaW/8K5DMhiUswx/xGCgoKCgoKCg4Mff/zxysrKI0eOTLRFChIUFDTRJgAAMPGIzzGjo6ObN2+eNWvWtGnTVqxYcePGDYZh7t69u27dOr1eP3v27Pfee290dJT5Z41i9+7ds2bNCgsLW7Nmzd9//80wzGefffbCCy/gBrds2bJmzRr81uFwxMTEDA4OTpky5ZtvvkGFn3zySWxs7MyZM1999VWHw4EKh4eH33jjDa1WO2fOnHfffRd1yuW3335btGhRcHCwXq9fsWLF1atX8Ucffvihl1VEL1atWvXBBx/goxYtWoRMEu1aLmq12ul0Sq9PdA0FfM+ePbGxsWFhYa+88gqO1dWrV1944QWtVjt//vzvvvuO36DQYAn19dtvvz399NNarTY6OnrZsmXnzp1jBMaO4axWUSz02Tt6OmH4I44a3Llzp16vj4yM/OqrrxhSDixdunT37t2okT///DMoKAjbvG7duo0bNwpFg5gkxE7pvtODRh9ZoeDw3fRaURRaduvp6XnppZe0Wm1sbOyePXtwHaKzQvkgNMTc3oWyUdalhoiQp7IaAXxGfI7ZtWuX1Wq1Wq0dHR1RUVFnz55lGKawsNBut7e2ttbX1x87dqy6uhpVHhwcbG5ubmlpaWlpaW1t3bVrF8MwFouloaHhzp07qM6xY8eys7Nx+9OnTz9//jxaSsrNzUWNsCzb1NTU3Nxst9s3bdqEam7btm1oaKitra2+vr6hoWHfvn1epra2tubn5/f29ra3txuNxoKCAmxVyz9gq4herFy5sra2Fn3a09PDsqzFYpHStSwcDkd5ebnJZJJ+CMW1trY2FKvu7u7S0lJUXlBQEBoaevbs2bq6OuIcwwgMllBfZrN57dq13d3djY2N6enparWaIY0dsReihT57R08nfCBxxAcHB8+fP9/e3n7gwIH09HSGlANms9lqtaL6x48fd7vd9fX16K3VakWjRoyGUJLwOxX1nRI0+sgKBUfohBWloKAgMDDw0qVLVqv14MGDuJzoLCUfhIaYO2TEbJR1qZGLXxoBRPCIYTAYWltbuSUjIyMajeby5cvo7bFjx9LS0jweT2dnJ8Mw3d3dqLympiYlJQW9TktLO3LkCKqDUpDbICrErxmGuX37Nnrb1NQ0d+5c9Fqn0w0ODqLXLMumpqZSzL506VJERATFKqIXQ0NDoaGhqHJ1dXVWVpbErrku4JIZM2ZwndL9Q2BgYE5ODm6QfywdL9dwrBobG1GsRkZG1Go112VsCdc8ocHi9zUwMBAQEOA1ahTjcaGQhWPxziMhnYiuofKBgQFck5gDdrs9JCQEtZmamlpcXJyTk4MODw0NdblcQtEgJgm/U1HfKY5LGVl+cIhueg0cN1258VGr1fhAbndCZ4SUZMZDzO1d+klKqU9EyFNZjQA+E0CfgRwOx8DAQGJiIrewr6/P5XLFxsaitwsWLECjxTCMWq2ePXs2Lu/u7kavLRbL8ePHly1bdvz4cZPJRF+s12g0+N42KipqYGCAYZibN2/29/fHxMSgcrfbHRDgbfwff/xRUlJy9uxZl8vldrvdbjfFKqIXwcHBJpOptrZ2w4YNNTU1a9euldi1KCEhISzLMgxjtVo3bdq0f//+4OBg6YcLucaNldFoRLHq6+tjGIbrMrFNocHi9xUWFrZ8+fK0tLQlS5ZERUWlpKQ888wzEi0nWjgW7xgJ6STkmkaj4a4IEXMgMjIyLi6uqakpPj7ebreXlZXFxcWNjo5ardZnn332oYceIkaDkiRenUrxXchxKSPLD05PT4/QCUunr6/P7XZzD0QvfDgjhIYYI/0kpdRnGEav1+M2r1+/TrdKqBHAj0i6Vk6dOnWM3WRnZ6NVguPHj6MLt1ycTqdKpWppacHZrFJ5L/RZLJa8vLx9+/ap1WqbzZaZmelDRytXrqyqqsrNzW1ubq6pqZHYNfrmOzo6imM1ODgYEhKCK6hUqujoaIZh1qxZU1lZuX///g0bNki3yi+ujaWv77///vfff29vb7fb7cXFxU899dSnn36qaI8Uxp5OdEwmk9VqvXz5stlsnj59elJSUkNDA14oY0jRKC0tFU0SIn4fWaWDw0g7I7wYtwRG3+SASYTonY7BYGBZllsi8Qa2traWe++ZkJBgtVpnzJiBFwEwXmtlQrfwGo3Ga9WOS19fX0BAAH7LsizxjhhbJeSF0+kMDw//+OOPs7OzcWv0rhEGg6GxsRG/ra6uzszMJDp16NAho9GIF1tElxcorhFj5bWiUltbK7pWhsMi1BcXlmWNRiPFeO5ameiCjFzvEPR0IrrGN1UoB5qamlJTU7Oysurq6jweT3V1dWFhYUREhN1u9/DA0SAmCX1wib5THJcysvzgEN28ffu2SqXirsgJrZV1dnait9y1MqEzguivaFLJPUnplxovhDyV1QjgM+JzzI4dO1JTU9va2mw2W0FBQUNDg8fjycvLy8rK6u7ubm9vT05O3rt3r+efMVu+fLnNZmtvb09KSiovL8ftlJWVJSYmms1mfheDg4MBAQEdHR0e6pXlzTffTEtLQ18ed+3atW3bNq92DAZDdXX1rVu3Ojo6LBYLN5OIVhG98Hg8OTk5oaGhhw8fxi2Ldu3xeKqqquLi4hoaGvr7+48cORIeHo6nHP6JFx8fv2/fPu6nzn8zMjIixTWhWFksFq7LQnMMMSz8vs6ePZuZmXnixIn+/v7u7u68vDw8jtyx4zYufY7xwTsPNZ2EXCNe/oRywGAwGAwG9D3AZrOFhoYmJSWhj4SiQUwS0S8QfN/pjouOLDE4RDdTU1Pz8vJ6e3s7OjrS09OJTS1fvtxisXR2dra3tycmJoqejMR8ILrJ/VTuSUq/1PAhekpphPjoEfAN8TlmZGSkpKREp9Op1WqLxdLf3+/xeAYHB/Pz83U6ndFoLC8vRxdEdG5UVFQYDIYZM2a89tprQ0NDuB10D3vgwAFiL+Xl5SEhIQcOHKCcYE6ns6ioyGg0hoSEmEwm/O0G09DQkJKSolarIyIiiouLuZeqXbt28a0ieuHxeGprazUaDdd40a4RH330UUxMTGBgYEJCQk1NDdcLrwvNt99+GxMT43K5PP/kuhd4BhJ1jRgrm832/PPPazSauLi4yspK4hwjNFj8vlwuV3l5eVxcXGBgoMFgyM3N7e3t5Y8d31+Jc4xc7zzUdBIaceLlXigHcnJyli9fjqulpKSUlpai10LRICaJ6BzD953uuOjIEoNDdPPSpUtLlizRaDTx8fF79+4lNtXb22s2mzUaTUxMTEVFhZSTkZ8PRDe5n1Ky0YdLDR+ip0KNyP0NDkBnisfj8deyW1dXV0JCAv7dpBd3797V6XR2u32yqV/8N6EP1uQH0omCQsG5cOHC4sWLr1275sc2EXKz0S/Ze7+fAvcL4/c//x9//DE9PR2uCIBfgHSioFBwWJadO3euf9sEHnhk/wbXNxwOR1VV1erVq8enO+DBBtKJgn+Ds3379qioqKysrMuXL5eWlpaVlfmlWeC/wzjdx+AVz/HpDniwgXSi4N/gZGRkVFdXG43G3NzcwsJComwPANAQfWKDhFQ94/Uo7H554JaZmVlRUcEtqa+vj4qKEqo/sdGjPITHb/FAjwOUX6uL1pdSrihjCdR4BlkuXNsmVcCFDJhwYwApiN/HjLNY9/0iC5+dnY2VzRC1tbVI3GwSIhRVbvl4DvT9MspExhKoySx9L8W2CR+4CTcAkMtk1Pa/L2Ths7KyWlpauL+xIYozTh6EojpR0b4vRhngM+EDN+EGALIQmWO4Yt1Hjx5lBFT3GZLWN1HVXFQknyvETVRQ96qJJNCnTZu2atWqGzdubNy4Ua/Xz5w58/XXX7979y6qSZEHl2seZtasWWlpafhW5tdff3U6nRkZGVIk0yni7dL14WVtZCC0NSQu91JlF9XPJ/ZO3BmBottPDKzcDRq4iA6f3I0q+GPEl68XMpjfF30rBCmZLMVHIRl/+g4LErfY8Bo4+hlKtFaWs0IbH/CHHpi0iMwxXLHupUuXCqnuMwJa33xVc1ki+UQFdS7InsbGRpZl7Xb7ggUL+vv729raTp061dnZiRXRKfLgYzGPu1xWW1trNpulC7sJibdL14eXu5EBHS9VdlH9fGLvxJ0RREXdvRiLX6LDJ3ejCv4Y8eXrhQzm90WRvpeYyVJ8JLojusOC9C02uIieoUKXBYnOyk0eYDIi+sRGSKedq7rvIWl9E1XNpYvkU/TkcU2GYW7duoXeNjY2qlQq/HffpqamefPmecQkj+Sa52WAWq1GAVmwYEFtba1H+N/pXs8qGQHxdt/04UU3MpDyzN/rI7p+PrF3oZ0RiHZKeXIr3S9K9LjI3aiCOEZSDCb2JXSsxEyW4qOQjL+QL0K2CZ3s3DqiZyjRWlnOcsEbHwhlTnd3d0xMDMUYYEKQ9/8Youo+I6z17aVqLksSXIqevEajmT59OnptNBpDQ0OxYH5UVBR6NkiRBx+LeQzDzJkzZ8GCBXV1dUlJSUjhg1KZbzlfvF2WPrysjQx8gK6fT+yduDOCqKi7Fz77JTp8cjeqkLIrgZDBxL4oSMlkKT4KuSPRFy+TiCc7RvQMpVwWpDjLyEyeqKiopqYmUb+AccY//8Ekan27XC4p1SjNKqonz8cHxXK0XNbZ2ZmZmSlrP5ixG6C0WDpdIl6od/7OCHLt9NkvidEb+0YVXlAM9ntfPqSootDPUImXBQqykmHq1KmRkZG+OQIoh3/mmMjIyJCQkIGBgSeffBIXdnV1SalGZ+HChQsXLmQYxmQymc1mH+YYg8EQGBj4119/oS9358+fx1+sxm5ednZ2ZWVlR0dHcXExKgkPDx8aGrpz5w76Dmiz2aSbKt2A69ev2+32d955B73lfvVzOp1XrlxBX/k7Ojr+97//STeAyyOPPGIwGH766adTp04dPnxYYu8mkykvL+/gwYPPPvusVqul1PS7X6LRmz59enh4+J9//vnEE0/gQunpIctgYl9jR9THMbrjA5QzVOJlQQi5yQNMTsS/BOl0OqfTefHiRXq13Nzc9evXnzlzpqenZ/fu3du3bx9LNYZhzp079+KLL/788883bty4cuVKVVVVUlKSqLV8pk6dunr16qKioitXrpw5c6a8vDwnJ2eMXmAee+yxiIiI9vZ2s9mMSrRabUpKSnFx8bVr1y5evIiflIaHhzudzgsXLlB+qybdAL1eHx4e/vnnnzscjosXL5aXl3M/LS4uvnr1KnIWGyZqBn+gs7Ozi4uL09PTvX7JQ+k9KCgoMzOzrKwMaZnQ7eSbJNcvL3dEo1dUVJSfn3/69OmrV69u2LDhl19+kZUe/EBRDOb3RQyyXOg++uAO0S8pSDlD5Z5QXESTh5/Mw8PD0tsHxgkpD22QWPeePXsokuN8rW/i401RkXx8FF1P3iP8dJ3/liIPLtc8PiUlJXgvMoSQZPqmTZt827+AaKqsjQy4LWAz+C17qbJT9PMpUu1eOyNI0e3nmiR3gwbusaLDJ3ejCuIYeQVKKBTEvvhBFu1L9ETz8pHvjsQdFjwSttjgloueoURrZTkruvEBJZmBSYI/tf2BBwzQzwcAYIxMxv/5A5ME0M8HAGCMwBwDkEES8StXrpxoQwAAuI+BOQYgA/r5AACMHQXnGFFlId+kh4aHh19++WWvA2/cuPHqq6/q9fro6OjNmzffu3ePXo548cUXv/jiC/z2+vXrK1asCAsLmzJlypQpUyIjI9966y1Ff6nCjcBkE2IaHh4+evQo6A8CADAWFJxjlFDhHh4ezszMHBkZ8Sp/7bXX3G43y7InTpw4efLktm3b6OUMw1y4cKG1tZX7PT0/P9/lcrEs63Q6nU7nyZMn29vbKyoq/OsCFxAqBwDgAWcCf9Pmw28NOzs733//fa8DBwcHVSoVVwEpLi6OUo5Yv3791q1b8VuXyxUQENDX18ft7tSpU4mJiTLd8hH45SUAAA8eIvcxElXliaLufBlwIc12hmHOnDkzc+ZM9D81dODu3bv5Qu5z5szZsmWLl5H9/f0hISFcBaS+vj5KOcMwDofj0KFDXBnX3t7ewMBAvV7PMMyvv/768MMPh4WF1dXV4T/q9/T0vPTSS1qtNjY2ds+ePejXVuMjVO6bIr2oPQAAAEojvlYmRVWeKOru1Q5FptvhcGRnZ1dUVDz99NO40+bmZrkC9dLZv3+/2WyeNWsWLnG73Vj6CXnU0dHR2tqKZfgKCgoCAwMvXbpktVoPHjzIjY/SQuVyFekl2gMAAKA49NsciaryRFF3UQl0XMFkMq1fv96rU76QO7eCkEC9R+A/yZ5//4V47ty5LMtyS3DloaEhlUqF/pV94sQJVGFkZEStVuP/VNfU1OAuGGWEyrnIVaT3wR4AAAAlEL+PIarKP/fcc9HR0Xq9PjU11el0YlF3hmFqamqIf6rgH4XKt2zZUl9fn5KSwq3sL4F6Ij/88ENMTIyQWOHAwEBgYODMmTMZhjEajaiwr6/P7XZzJdNxfVlC5cQI0PFBkV6iPQAAAErjy+/KLBbL4sWLGxoaWJatq6tDhWi57ObNm83NzVlZWRKPGhoaqqmpOXTo0KZNm/j7vyrE3r17i4qKhD7lLpqJbnYiC2IEJOJ3lXgAAIBxQPYcgwW3H3744ejoaLy7qslkYlkWi7pLPEqlUtXU1KxYsSI1NXXr1q24PhJyR69FBep1Ot3Q0BCeomw2m8FgoJSfPHly7dq1er0+OTn59u3ber1er9erVCo0oyAx15s3bzIMg++fDAaDSqXCsuTnz5/3V9xEwSrx3EIs4Y7tUVrCHQAAwAdkzzFCgtteou4Sj1Kr1Y8++ijDMJWVlfv37z99+jQ+hCJQ78W0adOef/75goKCnp4eJKePFuuEym02W1tbG7qZ0Gg0LMuyLKvT6Vwu1x9//DFt2rT09PSKioqenp6qqirUxdSpU81mc1FRUVdXFzLJX3HDeAmVc//76RdFegAAgPHHl7WyI0eOfP311xEREYsXL547dy4uX7lypdvtFpoPhI5CzJ8/Pz8/H//USqPRpKSkJCcnp6enJyYmlpSU0E06ePCg2+1OSEjIyMhIT08vKyujlEf/Q0REhEqlQq+Dg4MLCwu//PJLhmH27dtXX18fHx+fkJCAu6iqqhoZGUlISDCbzb5d0OkR0Gq1b7/9dnJy8rffftvV1aXT6fBHJSUlGRkZS5YsmTdvns1mi4+PZxjm448/joiISE5OzszMzMrKWr9+vQ8mAQAAKMpk1Pbv6upKSEi4c+fO+Hc9Ojoq5cnHhQsXFi9efO3atXEwCQAA4P4FNDH/hcRH6yzL8m9EAAAAAC8CJtqA+4bt27dHRUVlZWVdvny5tLQUL8cBAAAAQsB9jFQyMjKqq6uNRmNubm5hYeGaNWsm2iIAAIDJzmR8HgMAAAA8GMB9DAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASgFzDAAAAKAUMMcAAAAASvF/PdCfluQ6mAsAAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	11 August, 2020 17:08 GMT
Vulnerability Verified:	12 August, 2020 08:06 GMT
Website Operator Notified:	12 August, 2020 08:06 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	12 August, 2020 08:06 GMT
Vulnerability Fixed:	13 August, 2020 03:00 GMT
—	—

JSON