Lucene search

K
openbugbountyDevl00pOBB:1285372
HistoryAug 30, 2020 - 6:22 a.m.

colina.e-com.cl Cross Site Scripting vulnerability OBB-1285372

2020-08-3006:22:00
devl00p
www.openbugbounty.org
6

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: colina.e-com.cl
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAfZ0lEQVR4nO2df1AU5xnHVzzhOA8UOE6EMwLjIFJL0EGq1hiGOAnFG3JaYoghStQaaglaJrGEMpZiSghBJzUJw1jioOMYx7EMwzAOdahjrwxjUa/n5UKREorXy0nhRDAXPI4L2z/eyTubfX/ccscBhvfzF7u3+77P87zP3sO+e/t9F/A8zzEYDAaD4QcCZtsABoPBYPxgYTWGwWAwGP6C1RgGg8Fg+AtWYxgMBoPhL1iNYTAYDIa/YDWGwWAwGP5i7taYuLi4O3fukDYZ0pkjoZsjZjAg82FE5oOPc5w5WmM+//zzycnJp59+GrvJkM4cCd0cMYMBmQ8jMh98nPt4qDH37t0LCQnBfjQ6Ovree++RNn2kubk5OzubtCkFoeUUL35IYN2Eobt3796C71i4cGFcXNzx48e//fbbmbFNOIIzZokv43727Nk1a9YEBwevWbPmo48+mpY2p8u8abHBi2tqJpkPPs4XeCr9/f1KpVLKR5QjvSAtLe3q1aukTSmI7HE6ndNl25wFOwQwdOBTp9PpdDrHxsaMRmNaWlpFRcXM2CYcwZm0xLtxP336tEajaWlpsdvt169fX7VqldC86colXy4Z323w4pqaYeaDj/OBuVhjbDbb0qVLXS4XdlMi01vznghQl4WhQz9tb29PSkqaAcNEIziLlkhEo9EIv5sMBoNCoXA4HNPbyyymqHfX1JPFfPDxiUDS85g//vGPcXFxERERr7322ujoKMdxo6OjsbGxDodjwYIFZ8+eFW6ePHkyJCTkgw8+WLZsWVhY2N69ex8/fgzauXnz5jPPPBMSEhITE/Pzn//8X//6F7a75ubm559/ftGiRejmt99++8477yxbtmzx4sUvvfTSgwcPwDHffPPNG2+8ERkZuWLFit///veiiRd03uzEiRNxcXFhYWGvvvoq8AiYt2nTpuDg4MjIyJdeeumrr75CbRsfH9+/f39ISMjKlSt/97vfUWZ4sKZi7RSatHjx4pdffvnBgwdvv/12ZGRkRETE66+//s0330hsnx5JEXK53O12U3y/f//+9u3bQ0JC4uLiTpw4ERYWRo82aXzpZggtwYYXxOe9996LjIxcvnz5p59+KjFiwnEn2Yb6Mjo6arVa09PToXnr1q27fv06+Bu2iVpFGhTRtM+9e/dgJIWQ0g9tU9Qg6gIlyUUjgvUCHQV6g6gBL7/88h/+8Ad4wKZNm86ePTtbPpLyijRevlykJMfnM55rjMPhMBqNHR0dnZ2dNputpKSE47glS5Z0d3eDGY+8vDzh5o4dOxwOR2dn561bt27dumUwGKqrq0FTWq02Pz/fYrG0t7dv2bJFLpdje6Q8jKmurm5ra2tra+vp6YmOju7q6gL7i4qKbDabwWBobW1tbm6ura2le2QymYBHFoultLQU7DcYDAcPHhwYGDCbzRqNprCwED23oqJibGzMZDK1trbq9fq6ujpSL1hTSXaCILe3txuNRpvNlpiYaLfbTSbTjRs3+vv7oYUe26dHUsjQ0FBZWZlOp6P4XlhYGBgY2Nvb29bWdu7cOXguyQvS+NKnxYWWkMLrcDi6u7vNZnNDQ8OWLVu8iBjJNtQXh8Mhl8tFFXHDhg2LFy8WtYlaJWVQSJDSz2Ob2OEgJTlAOCKoF9hRoDSIGrBr166mpibw6f37941GIxjf2fKRlFfTfpGSHJ/X0G9z+vv7OY579OgR2Ozo6IiPj4cfYefKwCkWiwXsb2xsTE1N5Xl+eHhYJpNh51gtFktsbCz42+FwKJXK4eFh7KZarTYYDKLT3W63Uqns6+sDm83NzRs3bhSaJ/pb6FF7ezv0SEhvb29UVBS6X6VSwTkT8CABPYZkKtZOaNLIyAg0KSAgYGxsDGx2dHSsWrVKSvuiERGFDvSiUqlUKlV4eLhcLi8oKMAOB/Dd7XbL5XJobWNj49KlSylekMZXZAbdEmx4wfFoCx4jBgNCss1j5qCI8lxoFU/IT/RKAZGkdCRMP/pAk1ygJLlwRLBeoKNAaRBrwNjYWGhoKPgSqK2tzc7OnkUfsR6R+vXxIpXi+HxD5rEIKZVKeNMaHR09PDzs8RS5XL5ixQrwd2JiosVi4TguLCwsJydn48aNGRkZ0dHRqampzz77LGy2o6MD/H316tW0tDQ4mSDcHB0dHR4eTk5OFnU3ODjocrni4uJgjyAhpHik0WigR//85z+PHj3a1dXlcrkmJycnJydFJz58+NBut8fGxoLNyclJmUzGcVxkZCQ8ZmhoiGQqxU6lUrlkyRJoUmhoaHBwMAyO3W4XWUIKhRBRJDmOUygURqOR47iAgAC1Wr1w4UL4Eer74ODg5OSk0Fq6F6TxRc0gWUIKL4iPqIUpRYxkG9YXmUwGpxDpiKySMigUsOnnsU3ScJCSnENGROQFaRRIDWINCA4OzsrKampqevPNNxsbG/Pz82fRR5JH/rhISY7PZzzXmGnks88+u337ttlsttlsxcXFmzdvBr8KXbhw4fLly8ExHn+1LPxmnF50Ot2BAwfq6urkcrnVas3MzBQd4HQ6AwICbt26Bb/7AgICOI4DX5co/jNVSvto6AICAmJiYrAHe/RdCtjxxU6UYS0hhXdaIOUeCpjynZiYEE6X3b59OzExEZ0uQ/F60ClDML2JRJ+6xI6Cy+Waai+7du36+OOP8/LyOjs7Gxsbwc5Z8ZGeV9N+kWIdn9fQb3NIt/nYj7BzZU1NTWCuTITRaNRoNKKdbrdbpVLBG1XRJs/zarXaaDSiZ01prgzr0eDgoEwmE5oHPRWiVCrRyRAsqKmU23BSkNFNSvui6QVR6CgzM1jfwVxZf38/2OlxrkwEGF/UDLol2PCix0uMGKkjmHskXzQaTVtbGzzebDbD35UJ8xxtHJufjx49CggIEM7qoOZR0s/jQHuc7hPGRzQiWC/QUaA3iI2h0+kMDw//8MMPd+7cObs+Yj0i9ev7RYo6Ps/xvsY4HA6ZTNbT0yPaBDUmJyfHarWazeaUlJTy8nKe57u6ujIzM69du2a32y0Wy4EDB7RaLWwZzJXr9fq1a9fCnaJNnucrKyvT0tJMJpPVai0sLNTr9WD/gQMHsrOzLRaL2Wxev379qVOnHj16JJPJuru73W63lBrD87xara6trR0ZGenp6dHpdMKkgccXFBRs3LgR/DtcXV1NeasDaypqJ90kHklfSvtCl9HQ0R8zYH3PycnR6XT9/f1mszk5ORmagfUCO76oGXRLsOH1vcZQcg/ri/D9GL1en5SU9O6774q6xnpBys+0tLQDBw4MDAz09PRs2bIFmCccL9IQYNsUdY26QImPaESwXqCjQA84NoY8z+/evTs0NPTSpUvwyFnxEesRZbx8vEixjs9nvK8xPM+Xl5crFIqGhgbh5okTJ5RKZVVVlVqtXrp06Z49e8CTMZfLVV5enpCQEBgYqFar8/LyBgYGRL289dZbpaWlsH3RJs/zbrf76NGjKpVKLpfrdDq73Q72OxyOgwcPqlQqjUZTXl4OLtqSkhJgnsQao9frU1NT5XJ5VFRUcXEx9n9hp9N55MgRjUajUCiysrJE/6F7NBVrp3f/lWPbhy6joaPXGKzvAwMDWq1WqVTGxsZWVVUJ/71AvcCOL2oG3RJseH2vMZTcw/rC83xDQ0NiYqJcLk9ISIBfmrynGkPKz97e3oyMDKVSmZSUdOrUKWgtHC/SEGDbRH/cIXKBEh/RiGC9QEeBHnBSDJuampRKJXwwPls+Yj2ijJcvFynJ8fmMhxrjBfTvMjoJCQk3btwgbTKkM+2h6+7uVqvVs24Gw0fmw4jMBx+fIGb0mb9H7t69S9lkSGfaQ2c0GuPj42fdDIaPzIcRmQ8+PkH4+rudGZPOZhrdM8/x48c//fTToaGhf/zjH6WlpQUFBbNt0UzgY6axRKXAgjMP8anGzJh0NtPonhXS09Nra2s1Gk1eXl5RUdHevXtn2yK/42OmsUSlwIIzP/FcY+7evfuzn/1syZIly5Yt279/v1AUCPtD+5UrV3799ddSpLmlLwcg7Ojhw4evv/56ZGRkTEzMb37zm4mJCVJfJGEoIePj46+88orodIrLf/vb39atW7d48eJNmzZ9/vnnUoyXEopZWX0A6/vQ0NCrr74aERERExPT2NjY0dExPj7+73//+/Dhw174Lh0pyeAxSqIDHjx48Nprr4FUeeeddyYmJrjvO/jrX/96fHxc2ALMNOy5HMf95z//efHFF8PCwpYtW/aLX/wC1cgCp2N7IbVJMgk9Ho0AZVCkL8whBd9TdFqU9qf3iwXl66+/Pnz48MqVK4ODg1evXv3+++/TV50QLlSxYMGCFStWwJGdJ0uKeMRzjcnKytJoNN3d3QaDwel0CidMKEmzcuVK9O10ESMjI5WVlVKsFHaUn5/vcrmMRuO1a9c6OjqOHTsmpS8s4+PjmZmZ6EvdFJdzc3PLy8vB62P79u3zotM5Asn3PXv2yOVys9ms1+tNJlNZWRn8yK++S08G6ezZs2dychKkyvXr1ysqKjiqg5wg07Dnchyn1WoTExO7u7tv3Lhht9sPHTpEOh3thdQmySTS8UK8GxR/RNsj01JjpveLBWXfvn0Wi+Xq1asWi6W2tra1tdVgMNBPUQoWqrhy5QocKa+/l35o0H8S4HQ6P/zwQ/j6mMlkgi9O+i6dLfEXaMKOxsbGNBoNlB7q7OzEannB9rFvLwoPePfdd9FfJ5Nc5nlepVJZrVae51taWpKTkz0az0tz05cf43kH1ncgB0kKrxe+T8ke36NktVrXr18P/nY4HAEBAUKBqYSEBLqDMNOw5/K4twiFuSE8He2F1CbJJOzxQgcBlEGhhMuLfPMxRWdSad9rU8fGxmQyGYy5d321t7cnJiZ60fsPFQ/3MUFBQYcPHwZ3fBMTE+fPn8/IyAAfQelsrJy16D4RVVYXrQ7AkXW/hRrdwcHB//3vf6GkR29vb3R0tLCvr7766oUXXggJCVm9evWFCxfo3q1cufK3v/2tdJc5jjt06FBWVtavfvWr0tJSUfvADOyiBkIoqwO8//776LlY+XFSrCSunkDyffHixY8fP4bhdblcgYGBPvpOUmUX6slLTwY6MTExt2/fBn/b7XaFQiEUmBocHKQ7CDMNey7HcZGRkQkJCZ988gnHcY8fP66rqwNCxaLTsb2Q2iSZhD1e6KDHQQF4XJjDu6UlpPCXv/wFDQ5HyFLKsgjosg4cOeXQXBKaQTcV6KdByRkRUlbT4DhOLpc7nU6OzZVBJNaixsZGmUyWnp4OXzXPyso6f/48z/OXL1+GajE2m00ul4+MjIjKu1qtrq+vHx4e7uvrO3nyJHgHCi4HAN5yqqurO3PmzMjIyMDAwJEjR3Q6nagjEd3d3dHR0Z2dncK+dDpdTk6OxWLp7e1du3YtvI9RIcB2SP/1oC7zPF9dXa1UKhUKhc1mEx0PBQ5g70DgQNR+aWlpbm5uX19fV1dXenr6xx9/TDmX5/nKysrU1FTwKnJRURF4FZkUK2ycvfAdkJmZWVVV5YvvPM/v27dPq9WK3tDmOG7Pnj0DAwOtra3d3d28tGQQWUvxCz0Ye1MrchBmGuXcvr6+0NBQuVwuk8kSExOFC5eREhX0IsUeoUkSj/c4KPn5+TabDbwEWlBQAD4SRhsclpeXZ7VagQyBSqUCZ/X09KSnpxcVFaH20IPf2dmZkZEhVC4XBgebpdg8R1NF+A4sKeVEuRQVFZWRkXHr1i00eqip2dnZWq22vb0dXZKOZKEwLCMjI1qt9tChQ+hH8xapNWZsbAwoNNTV1fHfl87GylkL40tSVqeMAdT9RpXhAVarNT4+/uLFi8J2gMSWcFkBeFlaETyaIXKZ5/n6+vrk5OSBgYH09PTMzExgJ3wzsZ+wqAF6cZLk69FzeYJcPDZWpDh74TvP8+Xl5du2bYPvbHvnO0WVXTSmUpJBdAzFL/Rg9Dta5KBI8Z50blFR0fr16zs7O69evarRaOrr69HTsb1IqRlCk6QcL2VQPC7M0T/FhRIApOD39PTs2rUrPDy8srIS5rkwOKQsJS2LwCHLOghrDPaSQWeAKysrw8PDd+3aBbWvSKY+evSopKQkISFBJpOtWrVKKFtAsRAW2sDAwN27d4uk7eY5U3vP/8qVK2A6uLGxMSMjA+7Pzc0Fehvbtm3D/ieYm5ubkpJSXFxcU1Nz/fp1sFN0jMFg2LZtW3R0NFhWBFxRoo4gGzduhAofsB1wFwWP6erqoj+PwZpBcpkXJJnNZlOpVJWVlTdu3EhJSYHtiHoHV7uo3AozMjw8HB6DPXdkZARIzYuswsaKJ8TZC9+bmpri4+OhFIrXvttstsDAQLi/p6cnKioK26mUZJjSRUv/jkYdFGYa6VyXy6VQKEwmE9h/4cIF+L2GTVRhLx5rhsgkKTXG46CQWpCoriTclBh8mUym0+lEjzTQrwtRlpLynCIjREo5kqnDw8M6nU74OA1rKsTpdHZ0dGzcuLGsrIxuoUKhAFW2oaEhKioKlmdWYwAensdMTEzcvHkTbsbHx9tsNg75iQhY/e3hw4ednZ3Yn4589tln4H8ul8tVXFz85ptvosfodLqtW7fq9Xqj0XjlyhWwE/tblPv375tMJmwjJCIRpury0NDQ8PDwunXrOI5bvnx5Q0PDsWPHqqurhTPyHoEy40aj0Wg0mkwm0roAQlD5cWysOEKcpfsO+OKLLwoKChobGyMiIsCeafF9SpAcFDJVvyCog5y0Xz0NDw+7XK4f//jHYDMlJcVqtZJOx/YyJZPozPygCCEFv6KiQq/XHzp06Msvv4QHi4JD+jbw31oYX375JZC8FP42D2sqJCgoaNOmTadOnbp06RLcibUQLFQRExOzd+9elUpVX1/vDxeeYOglyOl0ymQyeK/a3NyclpaGSmejctaUGg5/jSM8hiQvjyrD8zzvdruxqvWiubKmpiYv5sqwLsPGhffaBw8e5DjObDbDdjjcogai9pUE+XrsuTxOflziMgQwzlOaKxseHl61atWFCxeEO732XfpCkx6TAbWWPldG+h0XyUFhppHO5XleLpf39vaCvxsbG4HwO5qoaC+UNrEmUY6HNnscFP/dx1CCb7fbjxw5olQqweMf0lUMgFmKXRaBfh9DumREZxUUFCiVyuLiYuFtK9ZUnudFj2H0ej2cYJRi4cWLFzUaDZgJZPcxAM9zZVqtNjc312q1Go3GpKSk2tparGC7SM5aGF+SsrpodQBU9xvbEUA4n4s+87d+t6yAd3NlqMtg/6FDhzZv3mw2m+12e0NDg0qlioqKArfSvOAhpPX7ixqIJNxJ8vXYc3mC/DhWI52+eoIU391u97Zt24qKipwCfPGdl6DKDvCYDGgkPZKZmZmXlweeXW/ZsqWsrIzkIJpp6Llgf2FhYUZGRl9fn8FgSEhIgJLJwtNJvWDbpMScZAPE46CQiocw2hJrzFSD39/fn5eXhwaHlKXYPPdYY7ApJ8qlvLy8/u+WQaKbCoRfT58+bbPZRkZGgOWVlZXgMIkWJiUlgSe4rMYAPNeYwcHB3NzcpUuXajQasIoGVrBdJGctjC9FWV24OgCq+43tiMddBrAvq9X6/PPPK5XKhISEmpoa72oM6jLA6XSWlJTExsbK5fL169efP3++r69PoVAIsw1d1ID/voQ7Rb6+uroaPRcrP47VSKfEWaLv/cga1cKla7zz3aMqO4SeDGgkPTI4OLh79+7w8PDo6OiSkhKXy0VyEM009FwYh8LCQrVa/dRTT9XU1ICdqGA+thdsm5SYk2yASBkUoVXYhTkk1pipBh8iCg4pS7F5Tq8xpJTjkWVHpHPlypX09PTQ0FCFQpGcnHz69Gn4kUQLz58/HxsbC5KN1RjeO23/GZPOfrI0uudzSj3pvvuYaU9Wos4wfgrOk55y8wdvtP1nTDqbaXQzZgYfM40lKgUWnHmOr9r+s8idO3d++ctfzrYVc5GJiYlXXnnlf//7n8TjmeI6g8HwE09wjcnPz4+NjZ1tK+YiixYtCgwMfOutt6QczBTXGQyG//BcY4Ti1QsXLoyLizt+/DhQ2fJaQ9trJR/Y44MHD0wm05EjR3xskM6UmgWLGvjSgi8mifYfOXKkra1NSoMe3ws5e/bsmjVrgoOD16xZ89FHH2GPkb6gA8dxC3BQjvfrmgJ0sMsfMOYC2MuNMQeRdB+j/E682uFwNDU1tbS0AOnsmVcIhz06HA6FQhEUFDSTvT9BhIeHOxwOKUfSa8yf/vSnsrKympoaq9VaV1d36tSp48eP+2gbyKXu7u6lS5fCX+tSjp+t9RRIyx8wGAzpSJ0rCwoKCgoKCg4Ofvrpp0+ePHnx4kW/mjVVZDJZQkLCbFsxm3gXgfv37wPdQ9IBFRUVZ86c2b59e0RExLPPPnvp0qWqqiqvhXgBIJfkcjn8m/6/gtvtTk1NDQsLS01NdblcvnQ9JQYGBrZt21ZTUzNjPTIYPzy8eR4jl8vdbrdEDW0pIu2o3D2q6c19X7X7z3/+s7AFqHm+Y8eODz74AOy8c+dOUFAQXKnwjTfeePvttzmOu3///vbt20NCQuLi4k6cOAHXyiQJ42Ml90l+UaaAvvjii4iIiL///e8cWZlciv0cTrAdVX3HIhojuuL66Oio1WoVVqB169Zdv36dw4muizqSuNIByTAhdPl60toB2K4lyrMDsMsfMBiMKTHlGjM0NFRWVqbT6ZYsWQI1tPPy8jiOy8/Pf+6550TfdAaD4eDBgwMDA2azWaPRFBYWom1WVFSMjY2ZTKbW1la9Xl9XV8dxnMPh6O7uNpvNDQ0NQIJJ2OOOHTuw5mm1WvgcoqWlZXJysrW1FWy2tbVlZWVxHFdYWBgYGNjb29vW1nbu3Dnhufn5+RaLpb29fcuWLeAfbYfDces7DAZDdXU13S84+XP06NHc3FzY+Ojo6M6dO6uqqp555hmwx+FwdHZ2ilqWYr/D4TAajR0dHZ2dnTabraSkRMrA3bx587nnnsvPzxfuFE6Uoe6D5bNABYJs2LABLHaCDpAIrIMksMkDAGo0DQ0Nra2tP/rRj0SfFhUV2Ww2g8HQ2tra3NxcW1tL6bq6urqtra2tra2npyc6Orqrqwvs91r6jMFgeMDjGzRC8erw8HC5XF5QUIAV5CFpaENIIu2o3D2q6Q2NEb7li3Zhs9kUCgUwLy0trbi4ePfu3eD40NBQl8sFVJ6gehLU/8dKjlP0w7F+Qcxm81NPPWW326GdWVlZYFUJesse7e8nC7ZjA8UTNMx5CYrrlNfcsAMkUsGih070Pjkpeejy9ZS1A6a0UMKUJN0YDIZ0JNUYKF5ts9mEakVSNLQ9irRj5e5JF7bHGsPzfEpKyrVr1wYGBjQazcjIiFqtdrvd9fX1QK9TpDYv1P9HJccp+uEkdX3A5s2bm5qaoJ2lpaUBAQFnzpwROkJqmW6/FMl30WEkDXOPiutWq1VoJKl97E6KgxTLUQF2unw9ae2AKS2UQIfVGAbDFyTNlUHx6uXLl9P1t1ENbY8i7d7J3VPIyspqa2traWnRarVLlixJSUnR6/VwoomClAUIIBS/Pvnkk/j4+BdffBFsjo2NNTY2Xrx4saSkBD5c8Yf9JEga5h4V18G05MTEhPCs27dv+/jMnwSaPP6Qr8cmMJsrYzD8hccqRJ8woWtoSxRpR+XufbmP6ejoSEtLy87OvnLlCs/ztbW1RUVFUVFRYDFaMFcGdViFa2UKAZLjJP1wirq+1WpNTEyEk0j9/f0ymayrq4vnea1WW1hYCPdjW/Zovxf3MTxOw1yi4rpGo2lra4P7zWazQqFwOBxS7mNIDmItxwqwe5SvlzJXRl8oAcDmyhgMP+FTjZGioS1FpB2Vuyd1Cnu0WCykaRzQqVqtBk8XrFZraGgonF3heT4nJ0en0/X395vN5uTkZIowPkU/HOsXz/M7d+68fPkyfPIvdKS7u1sul4NVFCkt0+2XWGN6e3vR/VDDnJesuH769GmNRtPS0mK32/V6fVJSEhCillhjSA6ilpME2Ony9Txh7QBS11h5djqsxjAYvuBTjeElaGhLEWlH5e4pnYIe6+vrRf/hCtm9e3dOTg7cTE1NFaqLDwwMaLVapVIZGxtbVVVFEcanSO6T/BLdJoocKSoq2rp1K4wqSZmcYr/EGnP58uXk5GRscAASFdd5nm9oaEhMTJTL5QkJCej61kJENYbiIMVyEXT5ep68dgC2a6w8Ox1WYxgMX1jAI1+LTwqHDx82m81//etffWnk7t27W7dulS4fOV3cu3dv7dq1fhLDGB8fT0xMLCsr279/P+mY1atXnzt37ic/+Yk/DOD87OCc7ZrBYIjwRtt/jlBTU+PjrwM4jjMajfHx8dNiz9whKCjo/PnzP/3pTynHMMV1BoMxAzzBNWbRokUbNmzw4sTjx49HR0dnZ2f39fWVlpYeO3Zs2m2bdegFhsFgMGaGJ1jb32vS09Nra2s1Gk1eXl5RUdHevXtn2yIGg8H4YfIEP49hMBgMxhxnPt7HMBgMBmNmYDWGwWAwGP6C1RgGg8Fg+AtWYxgMBoPhL1iNYTAYDIa/YDWGwWAwGP6C1RgGg8Fg+AtWYxgMBoPhL1iNYTAYDIa/YDWGwWAwGP6C1RgGg8Fg+AtWYxgMBoPhL1iNYTAYDIa/YDWGwWAwGP6C1RgGg8Fg+AtWYxgMBoPhL1iNYTAYDIa/YDWGwWAwGP6C1RgGg8Fg+AtWYxgMBoPhL/4PzOVHKo5PvCsAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAUiUlEQVR4nO2dfUxTVx/Hr6XDtpRXS1WsIsQwJMQ3lOCCjrg8RllD2OYLYWy6SNAYnB1xxhHnmLipEBenhhmXLbosWbZkjJBtMYZMA8wZplixaAGjlJfCassEKxZE+vxx89zn7p6Xe0t7edvv81d7Ofd3vr9zzu3hvn3PDK/XywAAAACADCgmWgAAAAAwbYE5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJAL8TlmBo7Q0NBxEDee9Pf3Hz16dMy722w2UpuMITIlGoX33ntPrVZfuHABW/vYYgYEKVX72f4AAExOZoi+5z80NMQwTHt7e1paWm9vL8MwHR0dK1asePz48XgIHC9sNltycvKYk6LsPobIY9jF5XLp9frGxsbk5OSgoCA0lJ8J+snQ0NDMmTMpBSZWHgAAMqEULcH+NKhUKu5zcHCw3LIAX3G73RqNZunSpRMtBA99ggEAYLoy9vsxn3/+eVxc3KxZs956663+/n5u+9DQ0I4dO0JDQ2NjYz/66KPnz5/z92Ivm5SXl8+ePTsyMnLbtm1Pnz5l//Tnn3+uXr1arVZHR0dv3ry5u7ubLXz06NHo6Oi5c+d+9dVX2GJc2BMnTsTFxYWEhGzdutXlcr3//vvR0dGzZs165513njx5QpHX39+/cOFCt9s9Y8YM9loTWgwrRrRNBJGl6yTx5MmTnTt3RkdHz58//+OPP2b1u1wugX4Wfu0//vjjmHuNbfY1a9aEhobOmzfvjTfeuHv3LsMwz58//+CDD2bPnh0SErJ582aXy8X1Bb+huGtlpN5H2x8AgOnBGOcYt9ttNpuvXr3a0NBgt9sPHDjA/enw4cODg4NNTU0XL16sra09e/Ysum9DQ8P169evX7/e2NhYVlbGbm9sbCwoKOjt7bVYLAaDobCwkC1stVotFsv58+fT09NJxThJ9fX1ZrPZbrcnJiY6nc6mpqZr1661t7cXFxdT5IWHh1utVq1W6/F48vLySMVQMaJtgkaWqJPEu+++a7fbGxsbL168WF1dXVFRwTDMrFmzBLWw8Gt/7bXX/Ok1o9G4ffv2jo6O+vr69PR09ry2rKyspqampqamtbU1Jibmzp07XFOQGgrb+2grAQAwTfBKo729PSIigvvMMMzAwAD79erVq/Hx8VxJnU7ndrvZz2azOTU1VRCHYZiOjg72a2Vl5cqVK9Hq7t27N2fOHLZwX18fSRVbjAv76NEjdnt9fb1CoRgcHOQULlq0iC6vvb1dq9VSsqCLobQJP7JEnQIxHCMjI1qt9v79++zX6urqtLQ0rH6+MHa7P73W19enVCo9Ho8gOHsHCNsU/IYSaMD2Pkk/AABTGvH7MVi0Wi33pFBMTExfXx/7+e+//3Y6nQsXLmS/jo6OKpXCKlQq1fz589nPiYmJHR0d7OebN2/u37//zp07w8PDo6Ojo6OjbEWRkZH83bHF2JLh4eHsZ4PBEBYWplarOYVOp1OiPEoxVIyUNkGLieok4XA4hoeH4+Li2K+JiYnsr7ZExtxrkZGRmzZtSktLW7duXUxMzMqVK19++eX+/v6+vr4lS5ZgKyI1FKn3AQCYloxxjiHh8XgUCsX169e5HymFQurluOzs7Pz8/LNnz6pUqq6urg0bNvhTzB952GLDw8PSK5paSGmW77777saNGxaLxW63FxUVvfTSS0eOHGEYhv8MGwAAgIAAzzFz587VaDR9fX3Lly8nlfF4PJ2dnew/s62trQsWLGAY5uHDh3a7/cMPP2TLkP6dl1jMH3mkYjabzae65ECv1wcHBz948IA9lbFardzJhz9IbJaUlJSUlBSGYTIzM41G4+nTp6Oiom7duuXTw2zY3gcAYLoS+Pf88/Lydu/e3dzc3NPTU15eXlpaipYpKirq7u5ubm4uKSkxGo0Mw0RHR0dFRX3xxRf9/f1tbW0lJSXY4BKLjUGeTqfzeDxtbW3Ss5CIILIUoqKiPB5PS0uL4PmuoKCgnJwck8nU2dnJtl5ubm5Aaqfne/fu3Y0bN16+fNnlcnV2dp45c2bZsmUMw5hMpoKCgtu3b3d3d+/Zs6eurk5KdmjvS9cJAMAUQ+J9G8E9f/7tWf6fvF6vx+MxmUwGg0Gj0WRmZnI3qPn7Hjt2TK/XR0REvP3229wd79ra2pUrV6pUqjlz5hQVFUVERGDvA6PFRCXxv1LklZSUaDSa8+fPY4vRb0rTBXCRpes8cOAAJ4aP2+0uKCjQ6XQGg6GkpGRkZAQrgA9b+4kTJ8bca8PDwyUlJQkJCcHBwXq9Pi8vr7e31+v1joyM7N+/X6fTqVSq7Oxsp9OJVcK/50/qfe8/2x8AgOmB+Hv+gQVe5/43A70PAP82wBMTAAAAkAsf5pi4uLhbt27JJ2VqyQBY/g3dMSVyHDeRU6I1gMmD1Dnm9u3bo6OjE26HNUlkACz/hu6YEjmOm8gp0RrApELqHFNdXZ2VlcUwjM1m4xz+g4KC4uLiSktLUXsrErGxsf5cjg+UDOn4Y4l/4cKFxYsXq9XqxYsXnz59OiAxAyUvIBq47pCIn73vKxOSo3y0tLRs3LgxPDx89uzZO3bs4NvNUUQGdmEFtCL51owYh9UoSFVM4EIY0xCJzwakpqZeunTJ+79Hgzwej8fjGRwcZH1HDh8+LONzCRMtA/VQkcK5c+cMBsPPP//sdDqvXLmyaNEivryxxUTxx4LFfw1cd0xaplOO8fHx+fn5dru9q6srNzc3JyeH+xNdpGgjSB9F2IoCNZgFjIO9kKgDE+A/kuYYu90eERExPDzsxbV+fX19UlKSLOompQyJGAwG/tHY2Nio0Wg4T7BAMYEHA787piuTJ0ePx3Py5EnObq6pqclgMLCf/RcpcRSNc2vAHDM9kHStrLq6ev369S+88AL2ryqVamRkhCG47jMM09PT8+qrr4aGhsbFxZ04cYJzssLa1GM95H2SgbWpJxnOi9rs88+aSdrQRPr7+7u6ujIyMjh5y5cvv3LlCvtZ4HUvWC+AYpjPRbPZbFhDMFIXoDEFAdEU+O0TGRn55ptv8i/O8LsDmwWlF7AxsYNh69atn3zyCVfj6tWrL1y4EMAc6ZIEQ460/AG2v0Trogw5bNYzZ87cu3cvm86zZ8++/fbbdevWCURidxQ0AjqG0YUVSC2MPQBF4/MLowo/++wzKQOb0k0Sj3dKXsePH0eXGhEguvgFQELqHEO62vvw4cODBw9mZ2czZNf9wsLC4ODge/fu1dTUfPPNN9y+WJt6rIe8TzJINvWo4byvNvskbWgibrdbpVIJjsZVq1aFhIQIYqKqSIb5UiB1gWhMbF+43e6mpiZ2LYCOjg5Bg/C7A82C0gvYmFgBW7ZsqaqqYgv09PSYzebs7OzA5khPk58jKSNsvZS6RIccNmtO0k8//aTRaBoaGs6dOycQSd+RBR3D6MIKpBaWcmuKcvxiFa5fv54ekIPUTdKPd9LqIdf/B3+pEQGii18ARETPdNxut1ar5azaWaNfnU6n0+mioqJUKtWuXbvQC7Kc6/7IyIhKpeLeG6+srGRfL8fa1JM85H2SgbWpxxrOM77Y7JO0YRORaAqAXS+AZJiPfUufUhHXBdiY/B1JKTC8tQDq6+v5awHwuwObBaUX0JikNQsGBwfDwsLYtQAqKiqysrICmyNFkhcZcqTlD9B66XWJDjl61oODg7W1tcnJyWfPnhWIxO7IbwTSGJYyigStgd2Xcvxy4gUKKc4X6KIY2G6SeLxj8yItNoE2CH3xC4CCuCfmpUuXUlNT+SewGo3GbDYzDKNQKPR6Pee8i3Xddzgco6OjfDt69gPWph7rIe+TDIpNPWo475PNPkkbNhGlUsleuBNFoIpimC8FbBeIxiQtGcBfC8BgMPBXKxB0hyALei+gMUkC1Gp1ZmZmVVXVnj17Kisrt2/fHvAcKWnycyRlhK2XXpfokMNmzaFWq9esWVNWVnbw4MGdO3fyRdJ3ZMhjWAC2hdEDEEU0vqhCCthu8ul4x+YlZbEJiWuCAFjEWwo9QVYoFPPmzUNL+uO6z4F6yLNP/UqU4c/iAmPWhsJeeXj27Bn/ctmNGzcSExPRy2UoYzbMp3RBYE346ZdNAtgLW7ZsOXPmTF5eXkNDQ2VlJTNBOdIzCvgCB2jWz549M5vNq1atYgvEx8fb7XYG6Qh0RwFSxjC2hSU+wy0aX6CQtMySRHwaaWP+gZL1V2X6Qz/NGRkZ0el0fIdE0mm1w+FQKpXcV7PZzF0TU6lU7e3t7Hb6tTJBTLPZzD48I12G1+vVarWi15rQLSR7SlJFfG3YRAwGQ01NDVfeYrFwz5UJPCIFkfV6vdlsFmwcGBhQKBT8awWoPFIXYGNKuVZGah9Bd2CzkNILXEzKYPB4PFFRUSdPnnz99dcDniNdkmDIYTPC1utrXehXQdbsFqVSyV38qa6uTk1NRUWiO1KOFG4Mi44itCK+bNH4fAQKSQPbi1wrIzWdxOMdm5fgWllVVRXpWhmp9wFRROYY9sovfwtlSOn1+oqKikePHrW2tmZnZ3ODYNOmTdnZ2e3t7RaLZcmSJdz2/Pz8rKysjo4Oi8WyYsWKU6dO3blzZ8OGDb/99pvT6ezo6MjPzzcajb7K2LVrV1paGvufVFlZGftWiv9zDEkbNhHvP9+Pqa2tTUpKOnLkiKBqbBaffvppampqU1NTV1dXYWFhbW0tuz01NTU/P7+3t7e1tTU9PZ2VNzAwoFQqrVYra8BM6gI0pqBqNAVK+wi6A5uFlF7gx8S2IUtubm5YWNgPP/zAfg1gjhRJ6JDDZkTqL5/qwn4VZO31eo1GY05OTldXl9lsTkpKqqioQEWiO/IrJY1ht9utVCpbW1tJLYytSHp8ukLswPb+c2xTmk7i8Y7Ni51jNm3a1NXVZbFYli1bVlJS4kUOK1ItgBRE5ph9+/YVFxfzt1B+3LGu+16vt7e312g0arXahQsXHjt2jNuO2tSTPOR9koG1qfd/jiFpwybCbj9//nxiYqJKpUpISOD/aNLnGKxhvtfrvXfv3rp167RabVJS0qlTp7CrAJC6AI0pqBpNgdI+gu7AZiGlF/gxSW3o9Xqrqqq0Wi1lDYgx50iRhA450vIH2P7yqS7sV0HWXq/X4XDk5OREREQYDAb2/xVUJLojv1LKGOYvrIC2MLYin+JTFJIGtpc3tilNJ/F4x+bFFisrK0MXmxAsrkFf/AKgIDLHJCQkXLt2LYD1Wa1WvV7v614BlwH4w7+hO6ZEjuMmckq0BjA5Ge/1Y77//vuTJ0/+8ccf41kpAAAAMCGMxxN4paWlMTExWVlZ9+/fLy4uPnTo0DhUCgAAAEw443EeU1dXZzKZLBbLggULCgsL9+7dK3eNAAAAwGRA/Clv6b7fHAJP+zVr1ty4cWNoaKitrW18JpjHjx/v3bs3NjZWrVa/+OKLx48f5wy4uDK+5oWNKX13Xy3WwV0cAIDpgOgdG18tSOme9uMD+7S01Wp1OBw1NTUZGRkNDQ3ef5qQ+5oXKaZ0fLVYl8kyHQAAYNwQv1Zms9mSk5OlLy01f/78r7/++j//+Q/79ebNm+np6Q6HQ8r77QHh6dOnYWFhTqeTM+3A4lNeEmP6ia9NDQAAMMkRuVYm8P3GOpYLypM87bFu26SAWIdwum04B2tDhBoK8a8+oX7mdO9uUkyGasWPLiXA/am8vFxgJy6QxFdLMTYnrZsAAAAwGRCZYwS+3yTHcg66pz3qtk0KiHUIp9uGc4SEhGRmZubk5Pz+++/sghyieTFi3t2UmCRLeTRZfis1NDQI7MRRSYJdsMbmpHUTAAAAJgWiV9O4mwRSHMYoNzlQt21SQKxDuKhtOJ+BgYEDBw4kJCQolcpFixaRXlznfxX17sbG9JKt+BlkKQG+nz9qJy6QJMXYnLRuAgAAwCTBh/djKI7lHHRPe4HbNikg1iGcZBseHR3NBXz48CH7gb1OdfTo0aGhocbGxqKiopGRkfz8fJIwKd7d2Jj79u0jWcqj1uIcUuzE0WhYS3zsugkAAACThAC/g0nxtPcpDtYhHLuRXUKGxMyZM1evXn3q1Km8vDzKHOOTdzc/5r59+xgZrN0BAACmBz7MMXq9Pjg4+MGDB+w/zlarlfvHnyM8PNxgMNTW1r7yyivslubm5rVr1zocDl8DpqSkpKSkMAyTmZlpNBrZVSjQjdiVbJ48ecJ/jM3j8dBXDJs7d65Go+nr61u+fDmpDDZmeHh4VFTUrVu3li5dSokvwOPxdHZ2sqcyra2tCxYskL4vH71er1AobDZbbGwswzBWq3VscQAAAGRC/B1MnU7n8Xja2tqCgoJycnJMJlNnZ2dzc3NJSUlubi5a/tChQ9u3b//ll19cLlddXd2WLVuKi4uxDy6TAt69e3fjxo2XL192uVydnZ1nzpxZtmwZdiNWcEtLS3x8/JdfftnT09Pf319XV7d79270JIbLi/2al5e3e/fu5ubmnp6e8vLy0tJSiTFNJlNBQcHt27e7u7v37NlTV1cn2qQMwxQVFXV3d7NZG41GrCRRgoKCjEajyWSy2WxsKIk7AgAAjBNSbtpwvt8UA3Y+WE977OMA2IBYh3CJtuEsv/76a0ZGRlhYmEajWbJkyblz57AC+H7mot7d2JhegrU7ZSkB9sOxY8dQO3G+JIkLNJHWTQAAAJgMjLfvMiDfi5YtLS1r167966+/Ah4ZAABgbMCq1NMHs9kcHx8/0SoAAAD+z3h4+wPyAesmAAAwmYHzmKlNRkZGRUWFwWBgXRi2bds20YoAAAD+D9yPAQAAAOQCzmMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJALmGMAAAAAuYA5BgAAAJCL/wLbcrNKYxIU+wAAAABJRU5ErkJggg==)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 30 August, 2020 06:22 GMT
Vulnerability Verified: 31 August, 2020 08:22 GMT
Website Operator Notified: 31 August, 2020 08:22 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 31 August, 2020 08:22 GMT
Vulnerability Fixed: 2 September, 2020 14:02 GMT