Lucene search

K
openbugbountyBroly157OBB:1338832
HistorySep 15, 2020 - 12:36 p.m.

kajaki.pl Cross Site Scripting vulnerability OBB-1338832

2020-09-1512:36:00
Broly157
www.openbugbounty.org
3

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: kajaki.pl
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: Broly157
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAUSklEQVR4nO2dfUxT1/vAr1ixK+WtlsqbWJhBthFEZQQZGjaNIV3DOsYYskbxJaiEMEKYY8QwhqYyhotxGyHELcwQxh+MGGMIWzq2EcYMIqvYsNo5LKypHVYGWLFg9X7/OD/v7+6+9ba04Mvz+eue5557nuc85/Y+PeeePl2G4zgGAAAAAD7Ab6kNAAAAAJ5aIMYAAAAAvgJiDAAAAOArIMYAAAAAvgJiDAAAAOArIMYAAAAAvuKxiDGxsbFXrlxhKz7+PHEGAwAALA5LH2OuXr368OHDDRs2MBYff544gwEAABYNFzFmbGwsMDCQ8dT09PSJEyfYivw5f/58dnY2pcih1wNTOc66pYix8kIMDg0NdesS/i27a8y///67d+/esLCwqKioDz744P79+/Q2Oax1qdEDk3yEFy355ZdfNm7cGBAQsGXLlqtXr/pIywLx+IPJn7m5uV27dtH7S5ePjY0t+y+xsbHoFIczF4hXxoJohHzgo8/vU4bn85ipqSmNRsNW5A9jjPGgnbVr19pstsW5igwyeOHtLC2FhYXz8/M6na6np6e/v7+6utqty5+g7nvR1Pz8/JqaGrPZnJWVtW/fPq+06XU8/mDyZG5uLisry+l08pSLxWLHI44fP56UlITkT4QzAQ9Y4rWymzdvGo3GzMxMxqK7rFy5ctGuQpANXkg7S8u9e/eGhoaam5ujoqLWr1//2WefdXR0uNvIE9R9b5nqdDpTUlJCQ0NTUlLm5+e90uYTh9Vq3bFjR0NDAx+5UCjMyMhY+Yi2trbCwkJ06jF3pkAgiI+PZzwAXIBzYjKZxGLxqVOn5HK5RCJRq9VTU1M4jk9NTREttLS0kIsnT54Ui8X19fUymSwkJGT37t2zs7Ns7Tc1NeXl5dGLSC8S6vV6iUTS29uLigMDA2lpaUKhUCqV5ubmms1msqlsFdgaJMspvaZ3gV6Z0WB03NDQIJfLQ0JCCgoKkNNwHDebzTt37hSLxfHx8RqNJiQkBMkdDse+ffvEYnFMTEx1dbXT6cRxfHR0VCQSDQ0N4Thus9lCQkJ6enr420kfNbb6FNra2rZt28ZhLf0WInffpf/ZUKlU9fX16Fin0/n7+xN+Kyoq2r59+86dO4nKVVVVu3fv5nC1y/uE0efkBkUiUV5ens1mq6iokEqlEomksLDQbrcTNlRXVyclJRUXFyclJen1evrQoGPKDWy324uKiqRSaXR0dE1Njbt6XZpN9gPlc8roFnStRqORSqXh4eFnzpxhHGJu2MaXY9wHBgakUun8/DxPZ/KxkMM5jGPBdpO4S3d3t1fqPJW4nsfY7XadTtff3z8wMGCxWCorKzEMCw4ONhgMaNqrVqvJxTfffNNutw8MDAwODg4ODg4NDdXX17M17nKhbHp6Oicnp66ubuvWrUgyNDRUVFRktVr1en10dHRJSQmlTe4K9AbZes2nC2wre3a7fXh4GDltfHy8qqoKyUtKSoKCgkZGRrq6utra2oj6tbW1s7Ozw8PD3d3dvb29TU1NGIbFxsZWVVWVlZVhGFZdXa1QKF599VWedjKOGp9+Xbt2raKiAn39ZLOWWOs4cuRIfn4+pQWXA4RhWBgNDMOUSqVWq0UVLly48PDhw+7ublTUarUHDx7s7e29c+cO4fmcnBwOV7s0g9HnhOv6+vp0Op3FYklISLDZbMPDwxcvXjSZTET7GIaJxeLR0dGWlpbu7u6XXnqJ3k2M6X4rLS21WCxDQ0Pd3d3nz59vbGx0Sy+H2XQ/UD6nbG6x2+0Gg0Gv17e0tGRkZLANMeOoeUxLS0tBQcGKFSv4OJOnhWzOYRsLRm940M3CwsLt27dfvnyZ8eylS5e2b99OzNieObhDkMlkwjBsZmYGFfv7++Pi4ohT5G8oRBFdMj4+juSdnZ0pKSnoeHx8XC6XE5fY7XaxWDw5OUkvEq0pFIri4mI2865fvx4eHs5oD6UCW4Ns8xjGLlAqMxpMd1pfXx9ymtPpFAqF5GaJmYFUKiW+qOp0utTUVHQ8Pz+fkJBQU1MjlUqtVit/OxlHjWNoEGazOS4urr29ndtahF6vj4mJsdlsbG7EmfxPKKKA47jFYhGJRA6HA8fx1NTU8vLygoICdG1QUND8/HxaWlpHRwfRmsPhYHM1mxlkSxh9jhokJkN9fX1+fn7EbK+/v3/dunXo+MyZM0lJSVarNTMzMysrC2mRyWQULZT7zel0oocpKp4/fz4tLc0tvRxmM/qBYyaB3IKuJT6GZMhDzDZq3FrY5A6HIyQkBM3R+TiTp4VsznHrYcLRTTbsdrtGo5FIJHl5eUajkZAbjca8vDyJRKLRaMgz4GcKXmtl5CLxoOGIMUKhkJCPjIwQ94rT6bRYLMSpzs7O1157jbGIWquqqvLz8/v666/JJg0NDe3YsSMyMhItI9DtYazA1iBbjGHsAqUy3WBup1ksFkqzSD45OYlhmPQREomE8BiO4+ir/enTp3EaPO0kDOAYGkRaWhqhiM1agvT09HPnztG7zOF/ehcoJCcn9/T0WK3W6OjoqakpmUzmdDrPnDmTk5OD43hdXV1hYSGO41988QV9iRL/7/3JfZ+w+ZyjQUpRJpOhR6TFYpFKpRqN5uLFi8nJyWQt9PvNYrH4+/sTRaPRyBiD2fR6YDblFN0tHENDHmJu3I0x7e3tSUlJRJGPM11ayO0ctx4mnjE5OalSqQQCASERCAQqlYr46vBsIliEqRLB8uXLIyIiiCL3Qtns7GxnZ2d7e3tJSUlOTk5wcDCSq1SqAwcONDU1CYVCtAuFooWtAluDHuPxFjgKDofDz89vcHBQIPi/4fDz+/81TKvV6ufnZ7VaF66Im5s3bw4PD//22298Kn/55ZdxcXFvvPEG/ZTLAcIwjL7+cOvWLQzDFAqFVqsdHR1VKpXBwcHJycm9vb1arVahUGAYlpOTg9ZJLly44HLlgdsMbp+75NatW5OTkxs3bsQwLCIioqWlRaVSDQ4OIvMQXr/fFm42xm90EPQhZhs1D2hpaSE2j/FxJh8LOZzj1sPEs27+9ddf1dXVvb29tbW1hLC2trahoaG4uLi2tvb555932cjTCXcI8mweg5EWZM6dO0dZkEE4nU6pVEosGlCKJpNJIBCMjIzgOK5UKktKSpB8YmKC/DVBp9NR7GGrwNYgn7UyogvkynSDXc5jKKtP586dI4wXi8XEugGZqamp8PDw9vZ2iUSCjHfXTrIB3EPjdDqJ7nBbazabExISyGsXhEYO/7tcK8NxvL+/PzU1NTs7u6urC8fxxsbG0tLS8PBwYvqbmJio1WpDQkLQuhBbT13eJ2w+5zmfQM4hr4oUFRVhGEa8rGa73zjWynjOn9w1m3yK0S2MHwH6EOPeWyszm81CoXBiYoLwiUtn8rSQzTluPUw8WCs7dOiQWCwuLy8nVu0IbDZbWVmZWCw+dOiQy3aeSjyPMXa7XSAQEHcGUUQPMrRJQ6/XJycn19TUEC2g1XYcx3t7exMTEwk5pUjWazAYhELh8PAwKspkssbGxqmpKaPRqFKp6J8lxgpsDZLlhG1sXZiZmREIBAaDwel0chjM4TSVSkVulpAfOnQoLS1Nr9dbLJb6+vra2lokLy4uRotCx48fz8zM5Gknd4xhGxpyy9zW5uTkdHR0EC9dKRoZ/U92Hc6JTCaTyWSoWbPZHBQURKyZ4I92HymVSpeudnmfMPqc/7O+uLg4PT1dr9fbbLaWlha05eno0aN0wyg38IEDB7Kzs8fHx/V6/aZNm9DiJH+97ppN+ZzS3cL4BKcPMTduxZi6ujqVSkWW8Hcmt4UuncPzYeIuarXaZDJxVDCZTGq12rPGn3Q8jzE4jtfU1IhEIrQnkiiivct1dXX0DbLk1ioqKqqqqoimKEWK3tLSUrSbFsfx3t7elJQUoVAYHh5eXl5Of3YwVmBrkDz9ogQJxi5UVlaiLnMYzOE08m7ghoYG8t7lsrKy6OhokUikUCjQ99zBwUGxWIxmEg6HQy6Xnz17lo+dHDGGrV/0weWwlj4VJmtkGyDCdTgnBQUFubm5RDElJYXsZ51Ohz3ahsvtapf3CaPP+T/rHQ5HZWWlXC4XCoWbNm1qbW1Fe80Z98STb2COvcs89bprNvlzSncL4xPcrdUOugHc8oSEBMprHrecyWEhH+fweZgAXsT13eMuPN/uxsfHX7x4ka3oO73eamrhBi8cd7vsRRctFXa7XSgUMm4x4slT4AQAeIJY1Hf+ZK5du8ZRfPx54gx+Ovjhhx8yMjIgTxQAPCksfd5lr3D//v3+/v7o6OilNuQp5MqVK4cPH0bHDx48+OSTT/78888lsWR6ehrtWmY8S7ft/v37u3bt+ueff8gSuE8AYDF5SmJMUVFRSUmJT3P/PbMUFhbK5XJ0vHz58ocPH1ZUVCyJJcRrJMazdNtWrFjh7+9PlsB9AgCLDfdSGixeP4OgTL3o2Gaz+fn5kXcWOZ3OTZs2kd9FdXd3BwUFkXdtpqenoxf1MzMzpaWlMTExQqEwPj6+rq4OveJmk+OPNr9ROHXqFOWUQCBITExEKQk4bBsaGiJ+4Q8AwOLj+p0/n52LwNMExx45NhQKRWlpKTru7OyMjIxEmTNyc3NVKpXBYJiYmNBqtZmZmQMDAxxyQqPjv5A3XyHJxMREe3u7VCq9cOECz74AALD4eH9fGfCk40GMMRgMIpFodHTU6XTGx8ejbbKzs7MCgYCeSINN7lIj/VRTU5NCoeDZFwAAFh++/4OJDk6ePBkbGxsQEPDOO+/cvn37/fffDwsLW7Vq1d69e+/evYsuuXnz5uuvvx4YGBgbG3vy5EnGLUCXLl3aunVrYGBgVFTUW2+99ccff6D2T5w4ERYWFhER8dVXX2EY9uDBgw8//HD16tUBAQFvv/327du32ey8ceNGQEDA77//jmHY7du3Q0NDf/rpJ3KFu3fvHjx4MCwsbM2aNR9//PGDBw8onQoNDX333Xenp6dR/bm5uf379wcGBq5du/ajjz4i1ycbyWg2hy5KTTaHf/rpp6tXrw4NDd2zZ8+9e/fYLnfZKY6RYlM0PT0tl8vtdvuyZcu++eYb7tuDYP369UVFRZWVlc3NzUFBQXv27MEw7OHDhxiGEYk9CNjkHpCamqrX6/nX//777xeuFAAA/rjxzp9n7vGSkhJ/f//r169rtdqzZ88yNqVUKgsLC8fHx/v6+jIyMoRCIcaUvru+vl6r1Wq1WqPRGBkZOTIygrFk3naZBp8joTpjZniODOoUI+kSDl2Umox94UjXz18Rn5FiVETPBs+T6urqnp6eqqqq06dPI0lAQIBCocjPz//111+JryAccg+QSCQzMzP863PnYAcAwPtwT3MoWchc5h5HqYeIdEz0hPA4jk9OTgoEAsprHhNT+m4iGysZtmxCHGnwuROqM2ZE58igTsnTRZFw63KZAMrEma6fvyKXI8WmCPdorQyRn58fExNDlszMzFRWVsbHxwsEgnXr1hE/a2eTE4ZJSXAkl6PnJqBAuYQtBzsAAD7CjRjDJ9cFJXU5PSE8Ij8/Pzk5uby8vKGh4eeff6a3j+P41NSUQCBwmd6KDFsafHcTqvPMoM4o4amLDRO/dP0edIpSZFOEexpjhoeHQ0JCEhMTm5qa6GcdDkd/f39aWhqRhIpNbjKZRCIROe4SkXXhMQZBz8EOAICPWJrf+X/77beXL19GqevKy8vT09PZfnKxfPlyioQj87a30uAvPIM6T+h9GRwc9IWiRaC0tLS8vHzbtm25ubl5eXmU93ArV67csmXL6dOn1Wr1sWPHuOV+fn5RUVF8lE5OTgYFBbllJ2MOdgAAfISXY4xMJvPz8xsbG1u7di2GYQaDga3m5s2bN2/ejGGYQqFQKpX0GBMcHCyRSK5cubJhwwayHGVFpDM9PV1RUdHW1lZcXKxWq1944QWyVf7+/jdu3IiNjUVWET8qZCQiIkIkEhH/aeEWbumi98XpdDocjr///nvNmjUYhhmNxpiYmIUrYoSnIj589913o6OjXV1dzz33XEZGRnV19eeff45h2N27dwMCAsganU4nh9xdBgYGEhMT+dc/fPhwa2trUVGR0WhctWqVBxoBAHAP7mmOu2tl+KOfPphMJr1en5SURF/KGBkZycrK6unpsdls4+PjBw4cUCqVjGsaGo0mNTV1eHjYbDaXlJSgJKxsMKbBJ3A3oTqfDOqMEp662GBLv++xIo61MkZF+H+zwY+Pj5OX1BiZnZ2Vy+Wtra2oaDQaRSLR8PCwwWCQyWTNzc0Wi2Vqagr9G4JGo2GTk13q8vcxNpuNz+9jrl+/Tu6+yxzsAAB4F+/HGKvVqlQqxWKxXC6vq6ujx5j5+fmampr4+Hh/f3+ZTKZWq61WK+Mz1Ol0HjlyRCqVCoVClUpF//8fAsY0+OQK7iZU55MknFHCUxcbPNP1e9Yp/L8xhiPPP5EN3uFwUP4/ik5tbS3aE0FQVlaGwnxXV1dmZmZQUJBIJEpKSmpubkYV2OS4O7/zf/HFFym/86fT0dFB/k9fAAAWmWU47Z8YvMi1a9e2bdtGTkoIcDM2NpaYmHjnzp3HR9F7772n1+t//PFHX5vkdebm5hISEo4ePbp///6ltgUAnlF8+85fp9PFxcX5VAXgaxoaGtjegT3mrFy5srW19ZVXXllqQwDg2cX7MebYsWORkZHZ2dmjo6NVVVXV1dVeVwEsJitWrHj55ZeX2goPgQADAEuL97fkZmZmNjY2RkdHq9Xq0tJSlFYEAAAAeAbx7fsYAAAA4FnmKfmPMgAAAOAxBGIMAAAA4CsgxgAAAAC+AmIMAAAA4CsgxgAAAAC+AmIMAAAA4CsgxgAAAAC+AmIMAAAA4CsgxgAAAAC+AmIMAAAA4CsgxgAAAAC+AmIMAAAA4CsgxgAAAAC+AmIMAAAA4CsgxgAAAAC+4n9A2frkxU4ZpQAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAP8UlEQVR4nO3df0wTZx8A8LN2UGopv6v8UH7MASGEEUcIbEWdMcN0jHWIjDAmZCNgDEPXEMKAMYabIk6jXSWEsEXJ4jaCjBBiOsLY0iEjiNixyiojCLUWphUBS1cI0PePJ95777V3vQIF3Pv9/NV7eO657/Pcc3zpHX26yWw2YwAAAIADsNY7AAAAAP9akGMAAAA4CuQYAAAAjgI5BgAAgKNAjgEAAOAokGMAAAA4CuQYAAAAjgI5BgAAgKPYkWPGxsZcXV2Xd5jp6elTp04tb99VQQxgJR2xatUbtHkUJke0WWcZYY+NjW3atOmPP/4glX///fceHh72NmW1O/ZGhUIiuXDhwrJPyocffuji4nL58uVl7LtyY2Nj9o7kqgewKueFyrr/KgBrbI3ex0xNTZ08eXJtjrUxA1hdgYGBer1+vRo5d+4cqeT8+fNrdnRLPB7P9L/y8/OX1/6jR4+kUmlPT09mZuaqxPbMWcXzYtW/7EoENsG9smeVs7PzujTCZrMbGxvHx8fxkt9++02pVK7N0WmaItq8efPy2jcYDFwu98UXX0Qt/H9axfMCwHJyDOldM/Hd/Y0bNxISElxdXf39/Q8ePPjnn39iGDY9PR0UFGQwGDZt2kS6BTE7O5uXl+fj47N9+/ZPP/10cXERb//MmTNbt2718PDIysr6559/UP25ubn333/f1dU1MDDwk08+WVxcRJXPnj0bHBzs4eHxzjvvTE9PkwK2GsCFCxeCg4O9vLzeffddfBfL9klN3bhxIz4+3sXFxcfH59ChQ/fv38d/dPr0acuArXbw7bff/vzzz/Ed4+PjL1++bPPQVk8Bk+5jGHb79m0vL69ff/3VaiPM28EwjMPhJCUlyWQyvOT8+fMZGRn4ptUuk+5lYYzvvdAMOD3SEJ06dcrHx8fX1/err77CKE70o0ePSPPEsi93797dsmXLrVu3UH0PD4+ff/7ZZsz0w3v//v3ExERXV9ewsLArV66QWrt48WJiYiK+WVpampWVRTXONNcm7q233jpz5gx6/fvvvzs7O+PB5OXl5eXl2XVPbHx8/PXXX3d1dQ0ODj579ix+OKsjTPOrwOqJZj4twYa1yu9jkpKSsrOzNRpNV1eXUCjkcDgYhrm5uanVanRDg3QLoqCgQKfT9ff3y+Xy1tbWmpoaVG4wGHp7e/v6+vr6+vr7+6urq1F5ZWWl0WgcGBiQy+UKhaK2thZVHhgY6O7u7u3t1Wg0JSUlpKgsAzAYDEqlEu2i0+mKi4tp2ifq7+/Pzc2dmJhQqVQBAQH5+fl4wH1PEQO22sG0tLSWlhZUYXx8XKlUisVim4emYrP709PTKSkpVVVVCQkJK2kHV1hYWFtbi/LovXv35HL50aNH8Z9a7TJ+F6uoqCg9PZ1h1zDqAbeLwWBQq9UqlerSpUtCoRCjONFeXl6keWLZl+Dg4JKSkuPHj2MYVl5eLhKJXn31VSYx0wxvfn4+n88fHBy8du2aZY4Ri8UKheLJkydos7W1NSUlxWpsDEcjKSmpo6MDvW5ra1taWpLL5Wizo6PDsjv08vPznZychoeHOzo6Ghoa8HKrI0zzq4DmymI4LcEGZWZsdHSUx+MRX+Dl7u7uZrN5cnKSzWabTCaafYkWFhZ4PN7IyAjabG1tjYuLQ5UxDNNoNKi8ubk5JiYGvfb29jYYDOi1UqmMjY1FlWdmZlBhV1dXSEgIfQCkXbq7u/FdLNunGZDh4eFt27bRBEzVQaPRyOfzUf2amprk5GQmhyZ1AT8XVN3H64hEoqNHj9o1JjaHcffu3TKZzGw2FxUV5ebm4nOAqsuISqXasWOHXq+n6o6ZYqqQBpwUEoZh3gT5+fmWQzQ5OUnci2q0iUen6sv8/Hx4eHhFRYW3t/fExITVUEkx0wzvwsICh8MhTh40kkRxcXFNTU14eCaTiebasXptEul0Oi6Xi67T2NhYiUSSkZGBKvP5/OHhYebnBQWPh0EMnskI0w+amfG0BBsZexXTlYeHR2pqalxc3L59+/z8/GJiYvbs2UNT/8GDB/Pz88HBwWgzPDwcTSkMwzgczvbt2/FyjUaDYdjjx4/1en1QUBAqX1paYrPZGIbxeDz83X1AQMDk5KTNUIm7+Pn5oV2o2ie6detWUVHR4ODg/Pz80tLS0tISTcBUHXRxcRGJRC0tLR988EFzc3N2djaTQzPpi2X3S0tL5XJ5fX39CtshKSwslEgkhw8frq+v7+7uxstpzimGYbm5uVKp1MvLi1HHMAyjHnAiLpdLfCDE5XItu0a8ZcRwtKn68txzz8lksv3790ul0q1btzKMmWp4Hzx4gGEYcfJYNigWi9va2g4ePNjW1iYSiZydncfHx2nGmZ6vr29oaGh3d3dERIROpysvLw8NDV1cXOzo6Ni/fz/ziYeCX1paIoaBXixjPlOd6GVc3WBDsWM+zc/P25wo33777c2bN1UqlU6nk0gkL7/88pdffrmyCP/LZDKxWKy+vj48DBaLNT8/79D2SXXEYnFOTk5tbS2Hw9FqtQcOHFjesdLS0mQyWWZmZm9vb3Nzs8FgsHnoZTAajc3Nzd99911+fn5KSoqbm9vK20TeeOONoqKitLS0uLi4sLCwsbExm7tcvHgxJCTkzTfftOtATAacxWL5+/szb5PJiaY3MTHBYrEmJiaWHbNdUlJS0C2+tra27OzsFbaGYZhIJOro6BgZGUlKSnJzc4uOjlYoFB0dHSKRaOWNY8sa4VUfNLBB2HFpDQ4OhoSEYBjm6elpNBrxG8RarZZY7aWXXsrKyvroo4++/vpr/KmDVQKBwMnJ6e7du2hTrVbjf/iYTKZ79+6h10NDQzt27MAwzNfXl8vlTk5O+j/l6+vLPH6bbLb/8OFDnU738ccfP//88/7+/uhpE03ANB0UiURKpbKhoWH//v2urq4O6hqLxWpubj506FBsbGxZWdnKGySSSCRyuVwikRALqbp8//59mUwmlUrtOgTNgK8Ew9Gm6sv09HRhYeGVK1dqa2vRf7WsJGaBQIBhGHHyWNZ54YUXBALBTz/91NPTg9IAVWz01yYOPZJpbW1NTk7GMEwsFre0tPzyyy/25hiBQMBisfC/MNRqNXph73x20IkGGwL9rbT29vb6+nq9Xt/b2xseHl5bW4vKY2Njc3JyJiYmhoaGhEIhugk7ODh44MCBzs5OvV6v0WhycnKSkpJQfYPBwGazh4aGSO3n5OQkJydrNBqVSrVr1y6pVGp+ehM2NTVVq9WqVKro6OiKigpU/8iRI3Fxceh9UnV1dWVlJZMb0KQAaHaxbJ/UjkAgqKmpmZqaGhoaEovFaEeagK12EMnIyODz+Y2NjQwPPTMzw2az1Wr1wsKCzWdjpB+p1WoOhzMwMEBskOZuO9UwEquZTKbOzk7L+la7nJKS0tTUhD/5JzVF7BrxNdWAU4VktdxqBarRJlW22pejR4+mpaWZzebPPvts7969loe2jJl+eMViMXHyWB358vLyqKgo/IKiis1McW1aDVIgEKBzodVq+Xx+dHS0mfF5waWmporF4tHRUZVKFRUVZfNSovpVQHVlMZmWYCOzkWN6enqEQiGPx9u5c+e5c+fw8uHh4X379vF4vIiICKlUik78/Px8RUVFaGiok5OTQCDIzMwkPhGtqKjgcrmXLl0itm8wGHJzc729vQMCAioqKtD0RROrqqpKIBC4u7sfPnzYaDSi+iaT6fjx4wEBAVwuVyQSjYyMMJ+FeAA0u1i2T2pEoVDExMRwOJxt27ZJJBLilVBdXW0ZsNUOIi0tLTwej6Zrll0oLi4mdYFhjjGbzQUFBbt37ya2tsIcQyrH61vtsuVfNqSm8K6RXlsdcIYh0eQYqtEmVbbsS19fH4/HQ4/oTSZTUFBQQ0MDqXHLmOmHV6vVvvbaazweLzQ09IsvvrA68uiBE/HyoZpaVq9NSxkZGampqfhmTExMSUmJ5QhQnRfcxMREUlISj8cLCgqqqqpicilZ/VVAc2VRjRt4JmwyW1z/625sbCwyMhJ/vw8AmJ2d9fb21ul067vSDL07d+7s3r3777//Xu9AwAYCn/MH4BnQ3t4uFAo3coLBMEypVKJHtgDgVvN/lwEAjjA9PS2Tyez67OqaOXHihJ+fX3Jy8sjISElJSXl5+XpHBDYWeB8DwEaHP+db70Cs2Lt3b01NTUBAQGZmZkFBAVrnBgCcjRzz448/urm5PXr0CC955ZVXSktLMQx78uTJsWPHAgMDXVxcwsLCTp8+jZYkoipnLjAwkOHDGMs1r4gLNBFXfd+8eXNwcPCJEyfsDQaAdTc3N3f16tWNuVRlQkLCzZs35+bm/vrrr2PHjq13OGDDsZFjEhMThUJhZWUl2vzhhx9GR0fRkkHvvfeeRqNpb2/XaDQ1NTVyuby/v5+mfF3gq74bDIaWlpa2tjZYVxwAANaM7f8ru3Pnzq5du9BKUxERESUlJWhdYT6fr9frSR8dpyp3EMv/QBsbG4uOjn78+LHVn16/fj03N/f27dtrEBsAAADbz2PCwsJyc3OLi4vr6ur4fD6634pWE7JcWoaqnIhm6X57l/q3F4fDWVhYWN6+AAAA7MXomX95eXlnZ2dJSQm+FsiWLVtEIlF6evr169dnZ2fxmlTlJFRL99u71L9dHj58WFZWJhaLl7EvAACA5WD4Wc309PQdO3YQS2ZmZoqLi0NDQ9ls9s6dO/FPGlOV4+xdCZ9mqX/Lj3CTPuiOPV313dPTk8PhHDlyxOpXDwAAAHAERjlmYGDA3d09MjISX6+MyGQydXd3x8XFlZWVMSkfHR3lcDj45uDgoEAgMJvNOp3OyckJLx8aGsK/Q8JqfTODHMPlcrVarVar1el0pFQHAADA0RjdKysoKJBIJDKZrKysDD1OJ3J2do6Pj5dKpY2NjUzKVxH6qiXivyOj72PHN9Gq72jZ1//nb2gHAIB1YTvHXL16dWRkpLCwcM+ePUKhEP8cL+lxC/puPppyUqFdK+FbrY9hmI+Pj6enZ09PD96yQqGIioqy2SkAAABrgf5tjtFoDAoK+uabb9Dm0NAQl8sdGBhQq9UCgaCurk6n001NTSkUisjIyJMnT1KVE9u0dyV8mvpms1kmk4WGhioUCr1e39TU5Onp2dXVhR/I5re6AgAAcBwbOaayspL0xfLHjx9H35lx7dq1vXv38vl8LpcbFRVVV1eHKlCV42iW7rd3qX/k3LlzQUFBTk5OkZGRzc3NpAMtZ1QAAACshnVY29/epfthqX8AAHhGwZqYAAAAHAVyDAAAAEeBHAMAAMBRNuJ3LQMAAPh3gPcxAAAAHAVyDAAAAEeBHAMAAMBRIMcAAABwFMgxAAAAHAVyDAAAAEeBHAMAAMBRIMcAAABwFMgxAAAAHAVyDAAAAEeBHAMAAMBRIMcAAABwFMgxAAAAHAVyDAAAAEeBHAMAAMBR/gMhfbpVe/SvqwAAAABJRU5ErkJggg==)

Screenshot: kajaki.pl  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 15 September, 2020 12:36 GMT
Vulnerability Verified: 15 September, 2020 12:46 GMT
Website Operator Notified: 15 September, 2020 12:46 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 15 September, 2020 12:46 GMT
Vulnerability Fixed: 16 September, 2020 20:12 GMT