Lucene search

K
openbugbountyDevl00pOBB:1345161
HistorySep 17, 2020 - 5:47 p.m.

strength.or.kr Cross Site Scripting vulnerability OBB-1345161

2020-09-1717:47:00
devl00p
www.openbugbounty.org
30

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: strength.or.kr
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAaeklEQVR4nO2df0wb5/nAr8QQxzkIuMY1DiFAOwdFEaWMMSdjHUJRhjzEXMYYYozSNiIpiyhDXUZZxWjCSEZI1tEsQhGp0hal0RQhhKKIRSzqaMYylqUk9aiLKHOYYzzHow5zCXUc7vvHq973eve+L+fDDpQ8n7+44973fX689z6+9+593kc4jmMAAAAAIAJELbcAAAAAwKoFYgwAAAAQKSDGAAAAAJECYgwAAAAQKSDGAAAAAJECYgwAAAAQKVZEjElLS7t+/TrpEBARUftEqHLwKQA8nCx/jPnwww8XFhaefPJJ7CEgIqL2iVDl4FMAeGhZJMbcvHkzNjYW+687d+4cOnSIdCif/v7+4uJi0iG90cghbIhihCWioGa6fZYIXzlJMGWmQNVGzoxCbt68mZCQIP9iBSJ9+umnzz33XGJi4saNG3/xi1/cu3cvXKrJ6d7hdQ3Pz372s3Xr1r311lsKyv75z39+6qmn1q9fv3379g8//FCxDA8SUT8JowoPbIz6ysBRcTgcLMvK+RflSjq5ubkXL14kHcqXJ7wIG4pcowpqpttnifCVkwRTZgpU7YPxncPhiI+Pl3+xApGKi4srKiqcTqfdbs/Ly2tsbAyXanLqCa9rEF6vNyoqanR0NBgMKihuMBj6+vpmZmZaWlpycnKUyfCAEfWTMKrwwMaorwrLPFc2PT09Pj6en5+PPQRERNQ+Eap8lfn07t27165dO3ny5MaNG7ds2XLs2LFz584tt1BLxe/3azSaJ598cs2aNQqKB4PBnJychISEnJycQCAQdvEeAKtAhRWLrBjzu9/9Li0t7dFHH/3JT35y584dhmHu3LmTmprq9/sfeeSRt956S3h47Nix2NjYI0eOPPbYYwkJCc8+++zdu3dJNff39+/atSs6Olp6+Pe///3b3/52bGzsxo0bf/CDH3z00UeiRtHkwKFDhxITE5OSkk6dOsUwzOeff/7CCy/ExsZu3rz5V7/61f3795kvphGOHj2alpaWkJDw4x//GGnBMMz09PT3vve92NjYtLS0o0ePosdnUUMkI4j47LPP9uzZk5iYuGnTptdee03YtEhILP/85z8fffTR999/n1KKtw9FI6wFnnnmmSNHjqALrl+/vnbtWv76PXv2/PznP5f6gmGY3/zmN1gnYs9L/YV1MbYs1nSozu3bt69bty4xMfGHP/zhrVu3sJa5devWd7/73djY2C1btpw5c0ZqW1SK1CexniUVWbdu3b///e/169ejyyYmJoxGowLVpEh7nVT9RV3Dg+0GWP773/8K2yU1ioy8fv36xx9//Le//a1woqm2ttZisfz0pz9tamqS2h/bMSg3i8yhg2Qfyq1B6ScKVMCexw4dDzv0xxyHw8EwTHV1tcvlmpiYKCgo2Lt3L/qX3W5nWXZ+fh49X/OHk5OTDMOUlpZOTU1NTExs27atpaWFVL/FYunp6cEe6vX67u7umZmZycnJY8eOTU5OihpFslVVVbnd7oGBAbvdznFcU1NTeXn55OTk2NhYfn7+8ePHeS2qqqpcLtf4+HheXl5tbS1qpaSkxGq1ut3uiYmJzMxM/vFZ2hDWCEKef/75oqKiqakpm82WnZ3d2dkpbFoopNC86LHa5/OZTKaTJ08KzS4txduHohHWAt3d3bt27UIXtLa2qlSqs2fPosP09PRLly6JjI/qlzqRdJ7kL6nM2LJY03Ec19XV9eabb/p8PrfbXV9fb7VasZaxWq3CaqVzZXR1sJ6lSMtjt9uNRuPIyIgC1bCI7imp+nRdhFM02G7AcZxOgqhdbKMiIwvvFI7j2tvbWZbVaDQul0uqFLZjUG4WrBmxYlPsg701KP1EgQqk8yInYiV/qJAVY2ZnZ9Hh8PBweno6/y/s+xhUZGpqCp3v7e3l5zenpqZSU1P5In6/n2XZmZkZ6eHMzIxKpZqfn5fKI3xNwjAMXxyh0+n8fj/6e3R0NDc3V6rF5cuXkRbBYFCtVvM9pre3l+920oawRuAJBoMsy/JV9ff3m81mkpBSdSwWC38nkEoJ7UPSiGQBl8ul0WiQPXNzcxsaGioqKlA9cXFxgUBA5AuSE0nnSf6SyiwtSzKdiImJCYPBILUMcqKwWlKMIalD6t6kboxwOp3p6ekoVC9RNaGcpKl8pD5dF2FZbDdAYougtMs3SjFyd3d3Zmam2+3Oz88vLCxEpfR6PfovtmPQbxaszbFiU+xDutnDpQLlvMiYi0q+6lEt+qDDsiz/vYrRaJyZmVm0iFqt3rRpE/o7IyNjamqKLz48PMxfdvHixdzcXP6hW3iYkJBQWlpqNpsLCgqMRmNOTs53vvMdrGzCZ/ZPP/3U6/Wmpqaiw4WFBZVKJdUiOTkZaeHxeBYWFtLS0nhRFRvB4/EEAgFhVaivS4WU8stf/nJgYKC7u5uiGiMxF1YjkgWSkpJMJtPw8PDWrVtdLldzc7PJZLp///7g4ODOnTujo6PPnz8vrJwhOxF7nuQvkczYshTTffDBB/v37x8bGwsEAgsLCwsLC1LLeDwehmGE1WKNTFKH4llSEURpaWl9ff2PfvQjZarJAav+ooIx1Bth48aNChqlGLmpqWlgYOCxxx47c+ZMZmbmoUOHUB9A/8V2DIpZSKphxSbZh3Szh1EFynkRixp81bN4jAkja9asSUpK4g/pXy2/++67//jHP2w2m8vlamho2LFjxxtvvEGvf35+Pioq6urVq/wdFRW1/AuA6MzNzfX29p49e3bfvn0lJSUbNmwgXSnnq2WKBSwWy+Dg4OTkZFFR0YYNG7KysoaGhgYHBy0Wi8zK6WD9tcRqrVbr7t27u7q61Gq10+ksLCxcioRhZHp6+saNG3/9618j2opi9SndIDExUXTx7du3FTd6+/btmZmZp556imGYpKSk06dPW63Wq1ev5uXl8ddIO0ZTU5NMRXiwYoeleyhTAY1FcsaoRQ2++qE/5kgnxLCzSRx5rqyvrw/7LWAwGNTpdPzzsuhQxOjoaHJyMieZwpI+4LMse+3aNZlaoMdnh8OBzlPmykhGEKpDevynfMjocDhUKtXY2BjHcUVFRfv27SOpJrIPRSSsBTiOGx4ezs3NLS4uvnDhAsdxJ06cqKurMxgMLpdLanySE2U6F/lLKjO2LMl0Ho9HpVIJ64yPj8daRjgH0tfXt+hcmVAdSvemaBoMBuWYaylzZVj15etC6gb0uTJSoyQjo/Pj4+N8kZqaGoZhbDYbVkG+Y8iZKxPaXCo2xT6Umz1cKlDOw1yZCOUxxu/3q1Qq3jf8If/izul02my2rKws4ctSfvpyaGho27Zt/HnR4djYWGFh4aVLl7xe79TU1O7du4uKikSNYofvvXv3ms1m9Muivb39wIEDdC1KS0vRm2SbzSZ8k0lpSFhcOBu7e/fu4uJi6WtMqZB8KeF/7Xa7Wq2+ceMGtpTIPhSRsBZA6PV6vV6PWnc6nXFxcVlZWdLKOcHbV5ETSeex/pLKTOoYWNMhgU+cOOHz+cbHx61WKzbGcF+8y+WrlXqHog49xpC6Mfdl1ytQDYvonpKqT2lrdnZWpVLZ7Xb0qpnSDaQI7YBtlGLk2traHTt22Gw2r9d7+vRpnU5nMBheffVV9F/SjUy6Weg2F0GyD8mn4VVBzhgFcEuJMRzHtbS0aDSa06dPCw+PHj3Ksuzhw4f1en18fHxVVdXc3Jy0tpdffrmpqYmvSnQYCARaWlpMJlNMTIxer6+srHS73aJGScN3fX19cnKyRqOxWCzotxJFC7fbXVRUxLJsamrq4cOHsdqRiovO+/3+mpoanU6XnJzc0tKCbnWpkJQnpLq6uqeffhpbSmQfetiTWgBRUVFRWlrKH+bk5KA6RZXz9be3t4ucSDqP9RdWZmlZkuk4jhsaGsrJyVGr1QaDoaGhgRRjnE7nrl27WJY1mUwdHR1S76C/pX1y0cd0bDfmJDeCAtVICO8pqfr0thobG/mylG4gRWgHbKO8kTUaTXp6Om9k1FBjY2Nqaqparc7Ozu7p6ZmcnNRoNENDQxz5RqbcLCSbS6HYB+spbD9RrIKcMYru64eERWKMAuizQzwmk+nKlSukw2XBbrfzH5OsNCJqnwhVvhJ8ipDZJ5dY5OEBO10clmrB5quPB/rOX8jHH39MOVwWRkdH09PTl1sKPBG1T4QqXwk+BQBgeVnpn11FmoMHD546der27dt/+9vfmpqa9u7du9wSAasWtMFBIoH//e9/D0yGB9DQCuf69esvvvii6CQYJxIs23PMCiE/P7++vr62tjYlJaWuru7ZZ59dbomA1Qm/wcHo6Cj2ggeQlBo2WeCprq4uLy8XngHjRIplmaGTM5/r8/na2trkXxPeydz33nsvKytLo9GYzWb0rVdYCHUiO+wT38r0qq+vV6vVpO8swtWKHI+Ht8UIgbVSa2sr/226fGZnZ+vq6lJSUtRqtclkOnz4MP2rgc7OztTUVI1Gk5ubOzg4GKoMDocjKioKvesWnsS+TqeDvi0WVYWtNiQU3+bC3oXyTIuW6MtxUKite73eyspKnU5nNBobGxsDgcCila++l1IrN8bIsbXoGmleB8VEKF35sscYBXoJE7/LvAGUWW8pd9eKSi+PVUTZpgzo23q73e7xeAYHB/Pz80dGRkgXd3Z2ouxzXq/33LlzOp3u8uXLIcmAvh5OT0/n89BwSmNMZ2dnfHw8NrOfqNqQUNxJFl1aJ8dBobZusVj4bSDMZjP/PTQJNIKFcRxbCayqGBNGdDodWi11/vz5zMzMcFW77DFGgV6L3pxhaUV+5WFsMUI4nc7s7GzhGZfLFR8fT/8ZK2Vubk6lUvl8PpnXG41GlN4U0dXVhVZsyJfB4XBoNJrs7GxhbFAWY8xmc09Pj8FgILW4omKMTAeF1Lrf74+KiuLdd/nyZZPJFKLUq4FFYozVam1vb0d/j46OxsTE8CarqampqalhWbatrQ2tWuru7qZUJfw4va2tje9eIyMjZrNZrVbrdDq0QorjOJ/Px8/m8d/7P//88yzLpqSkNDc3B4NB0TXSPtTR0YHmDcrKyrxe78svv6zT6bRabXV1Nf8zTVotOt/c3JyZmVlbW5uZmSld8TsyMpKXl8eyrNFoLCkpQQv1OcJX/yTFQzUUVlSSJMFgsLGxUa/XazSa0tJSr9erTC+v10syMgUF1hN688iRIxqNBi1T93q98fHxwqEz1BYpC0qwfc/lclksFrRkSrSKAttV5NDV1VVWVob+HhgYoF/MX4BW8wkfKRBlZWWtra38odlsPn36NDKgcJQMBAKOL3JYiGTgqCtUbDabWq3mf9SHtCAMMTExgRa9WyyWvr4+/nxI9wLWO9KpC6lT0DXCcYkyVoiMI2fEw67gkb6DIK3UwbqPv/6hmyuj54R/9913GXLiehGkxNqkXOKiFNnYXOWiDPzCGMMwTGVlpdPpRPm9dTodSuGO9suqq6tDV5JSoCvL9Y3NWE5SnJT0m3Q9VlSSJG1tbTk5OTdu3HA6nXV1dfy0uAK9SEamqKDMesKGWltb0XLU2tpalCKa0hy9RX71uDRjPLbvkbZ7CClbvgjhvgkGg6GgoODq1avSy0ZGRgoKClD+YERxcXFRUdHly5eFkebcuXP8fKDL5VKr1T6fz+l0qtVqaZ1YGThydn3k38OHDycnJ6PhlRRjKNsWtLS07N+/n+O4M2fOCANbSPcCKXW/UAb6Xh7CcYnSjYXGkTPiYfvS/Bfs37+/vLxcKipvRqz7uIc2xtBzwk9MTDDkxPVC5CRg5wQJujmJh0hJ+7HPv6iTCZ9So6Ki+F8cw8PDTzzxBKVaZbm+sVmYKIpjExlRrpeKSpKE4zi9Xi9NV6VML8okA1YFZa2IKg8EAhkZGS0tLTqdjl8+TUr9RG/RsViWfgTqe5TtHkLKli9EuodFW1ubVqstKyvjM46Mj4+XlZVptdq2tjZhOJmdnW1sbDSZTCqV6oknnkCPC3Nzc3FxcUijEydOFBcXi6yHHtl1Oh2/VYFIhkXT6wWDQbPZXFVVxRFiDD0Vm8lkQk+Tc3Nzer0eZdoP9V6QeoeTPSxIxyVKNxYaR86IR+lLNpstJSUFTRuQYgzWfdxDG2M4jsvKyrp06ZLb7Ua/a/R6fTAY7O7uLikpkW8OFK75w7GxMb57Xbt2befOnUajEU1kYbNSouzc/G8crVaLRhBKjCHlkxAekqrlB2iXy6XT6dra2q5cuYJSeyHKy8uzsrIaGho6Ojree+89XseYmBj+mvHxcZRxkqR4SIYiiYqVxOfzqVQq6WSOMr1CfR+jrBVp5YODgwzD0BN8yWnR4XCITMqHH2nfEzlxUfvLobe3t6CgQHRyZmbGarXyWR1VKpXVaqW8epmfnx8eHubfG5eXlyPL7Ny5E/0AFz7HoMeaK1eu8J1NJAO2r3JfdsH4+LhGo+nr68PGGFINHMeNjIwIX0dVVVWhuaBQ7wXsyBDqsMBD6cYi49BHPFJfQuzYsYOfG6SMQlL3cas3xiy+PoaeE37pyEnQHaGk/dhql5LrOyRCSvpNsgBFEtHe7JHQS6rC2NhYuFpxu91RUVFut5vS3O3bt+XoRUJ+cvilZMuXbnDwySefNDc3Dw0NHThwAJ05cOBAR0dHbW3tgQMHHn/8cakAa9eu3b59e2dnZ2Vl5cGDB8vKyo4fP15ZWTkyMtLb28swDJoIunfvXnR09IYNGzZs2ODxeDQaDUmGRfna177W1tZWU1Nz4cKFkAr29PSMjY3xZpmfn3e5XPSVZ8pS94drWBAZR/GI9/vf/z49Pf373//+oi1K3beaWTQKUXLCyw+5pMTapATdnORXALtY0n4FzzHYahXn+pYzVybMPC9nrkx4PdYCWEk4jtPr9aOjo2HRK6S5sqVkShdW7vP5DAbD2bNntVot/yEDxWKUFh2EjPHYvkfZ7oFkf/o8j3TfhL1797Is29DQwH+IgfB6vfX19SzLCr/pEr3wHxoaQtNf8/PzWq329ddfLykp4f9rNBqFz4UdHR1o5lAqg/ytKPLz881ms/y5smAwaDAYRkZGeGtMTU2hB8SQ7gWZqfsXHRawJ0WKiIxDH/GwfQmpkJGRIZygo3xXhnXfan2OkfXtMiknfEjmICXWJuUSF6XIxuYqJ2Xglx9jsNUqy/XNETKWkxQP1VBSUSmStLW15ebmonf++/btQ+/8leklNKYogTwWxdYTerO2tha9K25tbc3Pz6dbjN6ig5wxHtv3SNs9hJQtn0e6b0JlZaXwcy8RDoejsrIS/Y2StJ48edLlcvl8PlQVv5CwoqIiLi7uD3/4A1+WXx/j8Xh6enq0Wu3w8DBWBk72VhSTk5MsyyIjiLyPrWFgYGDr1q2itkpLS48dO8aFeC9gvSNnCwPsuCTsXVNTU/yUF9Y4lBGP1JdKSkrOnTvHv/lHJwsLCysrK9GnRnl5ecL1MVL3PdQxhpQTPiRzOAmJtUm5xLkvp8gm5SrHZuCXH2Ow1SrL9c3J+HZZqHiohpKKSpEkGAzu379fp9Op1Wqr1Yp+MivTS2RMYQJ5LIqtx3uzpaWFZVn0a3F+fj41NfXtt9+mWIzeooOcMR7b90jbPYSULZ9Hum9CSFy4cCE/Pz8uLk6j0WRmZp48eZL/V19fH8uyouz3aJ1/TExMdnY2/8E3VgaZW1FwHNfV1cUbQeh9bA1VVVXoizIhb775JnpDE9K9QBoZFt3CgDQu8WPF/Pw8/+yLNQ59xMN+B4+dH/J4PBUVFVqtVrrOX+q+1RpjHuEk1gGA1cTNmze3bdumLOPkxx9//PTTT//nP/9R3PqWLVvefvvtb37zm4prWDorQYaVxksvvWSz2f70pz+tHOMspaOuZB72nJgAQGHp2z2shA0OVoIMK42Ojg6UnBSME2nCHGNE34fMzMzExsbevXv3o48+WrFbswCAkIMHDxqNxuLi4snJyaampubm5uWWCAg/0dHR3/jGN5Zbiv/n3r17w8PDycnJyy1I+AnzXNmtW7f4v+12e1VV1cjICMra+84774SxIQCQSahTEO+//359fT1aTLdv376XXnopouIBAMMwzz33XH9/f3d39zPPPLPcsoSZ8MQY7G3861//2u12v/HGGx988IHFYpmenl56QwAAAMBXiPDsg7l582Zh8kQEv7JJq9X6/f6wNAQAAAB8hQjbXstr164VHk5PT6Psk+GqHwAAAPjKsUiMuXnzZmxs7KFDhxITE5OSkk6dOsUwzGeffbZnz57ExMRNmza99tpr9+/fR5cJC/b39+/atSs6OlpU4R//+MfwKgAAAACsWBb/rszv99vtdpvNNjo6mpqayjBMXV2dx+O5du3a7OxsVVWVVquVpkLq7++vqKiQ1lZdXb1169b29vavf/3r4ZAfAAAAWMHQl2hKs2Rj8xRRcmVzX152i01sDgAAAKxKFn8fw7JsQkICf+jxeAKBQFpaGjrMyMhAcUjIxYsXc3NzhaV41q9f/8orr0xMTAQCga1btyqNjAAAAMBXgLC98xdCTyT+ySefoCyNfGJzAAAAYFUScozR6/UxMTH/+te/0KHdbkcvaXju379//vx5Uox58cUXs7KyDAbD+Pj4K6+8ErrAAAAAwFeGkHPJrFmzpry8vL6+/vjx47Ozsy0tLdXV1cILhoeHDQYDP5nGMEwwGOQ3EfL7/TabbfPmzUsTGwAAAPgKoGSu7PXXXzcYDNnZ2YWFhcXFxbW1tcL/SifKRkdHU1JS0N/vvPMOBBgAAICHhPDn9hflyv78888zMjJeffXVF154IbwNAQAAACucB7F/zF/+8pdvfetbkW4FAAAAWGnAHmUAAABApIjIt8sAAAAAwECMAQAAACIHxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACIFxBgAAAAgUkCMAQAAACLF/wGh77mgFgS4uAAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQKElEQVR4nO2df0wb5RvAb9BBW0qBAR2wIj9COrYswBwSMGySqXPWhnTK2ILoMBJmFsaQsAX5A3HTsYEkigtZZjTgH5qYSAhBQkyjCyAhCKwwYKUjCAUKYovACitY6PePN9/LfXvvXa8t5ce+z+evu7fvPff8uPee3nt3z+2xWq0EAAAAALgBj+1WAAAAAHhmgRwDAAAAuAvIMQAAAIC7gBwDAAAAuAvIMQAAAIC7gBwDAAAAuAvIMcBuIioqqr+/f3cJd6vOALDDgRwD7BoePny4sbERHx+/i4S7VWcA2PnYzzF7cPj6+m6BclvJ4uJiRUXFdmvhKh9++KFAIKivr6c2kqZNTExsV+C47NpuCJqamtLT0zdVL1vhTHo67Tp2sZvLxMREQEAA985Oq+Qmc7bMS5sbYoAd+znGbDabzWaNRuPv74+WtVrtFmi2xSwsLNy8eXO7tXAJo9FYU1PT1dWVnZ1Nbd8JpkVERBgMBvY+dvXcghyzW8RuL1yiCQAI+znG29vb29ubz+eTy15eXu5XDHAYk8kkFArj4+M9PT23WxcM3t7ermw+MzOj1WrT0tI2SZ2tEO5WnbcXF6MJ/P/g/P2YL7/8MioqKjAw8J133llcXCTbV1dX33//fV9f34iIiI8//nh9fZ26Fbograqq2r9/f0BAwIULF54+fYp++uOPP1JSUgQCQXBw8NmzZ6enp1HnioqK4ODg0NDQb775BtuNFFtdXR0VFeXj43Pu3Dmj0Xj16tXg4ODAwMD33ntveXmZRb3FxcXIyEiTybRnzx400UTvhlXGObtQ+8zMzBtvvOHr6xsVFVVdXU3OcrA7kCCI5eXlixcvBgcHh4eHf/LJJ6iD0Wi0MQFBNe2nn35yOnDIkOPHj/v6+h44cOCtt9569OgRQRDr6+sfffTR/v37fXx8zp49azQaSW9QfUVORDA5ih4CG5qamk6dOrV3715qrAMCAt5++23SCqwJZ86cqaqqQh36+/u9vb3J/hcvXrx69SpVOGq/ffs2PY5M7Vi32OjMsjk2mtjDBnsETk9Pv/baa76+vgcPHvz+++/pfmM5MrEHA3t/qky75hMEce7cuc8++4xcTUlJqa+vt5mVYpriczTQ3E8XLCEmsTscAI44mWNMJpNare7s7Ozu7tbr9SUlJeRP169fX1lZGRgYaG1tbWtru3v3Ln3b7u7unp6enp6evr6+yspK1N7X15eXlzc7Ozs4OCiVSvPz81FnjUYzODhYV1eXmprK1I1UqaOjQ61W6/X62NhYg8EwMDDQ1dU1Pj5eWlrKop6fn59GoxGJRGazGU00YbvRlXHaLoIg8vPzvby8RkdHVSrVd999x92BBQUFer2+r6+vtbW1qamptraWIIjAwEAbExBU086cOeNK4BQKRU5Ojk6n6+joSE1NRZe2lZWVKpVKpVJptdqwsLDh4WHSG0y+wjqKHgIbqJNOJpNpYGAAWaHT6diDq1AoVCoV6tDc3LyxsdHa2opWVSqVXC6nC+/5L9Q4MrVj3YLVGbs5NpoE5+GQn58vFouHh4dbWlqwOYbJ4QTzKGbqj4XFfIIgMjMzGxsb0fLMzIxarVYqlSzS6JpzDzTWP0xuxMaCit3hAHDFyo3x8XF/f39ymSCIpaUltNrZ2RkdHU32DAoKMplMaFmtViclJdnIIQhCp9Oh1YaGhsTERPruRkdHQ0JCUOf5+XkmrVA3UuzCwgJq7+jo8PDwWFlZITWMiYlhV298fFwkErFYwa6MQ3ZZrVaLxcLn88fGxsj+pHvZHWixWEQiEblhU1NTcnIy1gSqbqjdlcDNz8/zeDyz2WwjXCKR9PX1Yb1B9ZWNDlhHMelvtVpNJpNIJEICbazo6OggrcCaoNfrhUIh0jwpKamoqCgrKwvJEYvFa2trdOF09ZjamdyC1Zm+OUs0qTANB3QUUcWSR5FNLJgsoh8MXI5kMlIs5iNWVlbEYjGSVltbm56ebqUFmjy30NsdCjTH0wWLQ9jPAExiAXZ4zmUmkUhEXu2GhYXNz8+j5X/++cdgMERGRqLVjY0NHs92F3w+Pzw8HC3HxsbqdDq0/ODBg2vXrg0PD6+trW1sbGxsbKAd2VxHY7uhnn5+fmhZKpWKxWKBQEBqiG5RclGPpRtdGaftmpub29jYiIqKIvtzdODc3Nza2hp1QzRmOOJ04AICAjIyMpKTk0+ePBkWFpaYmPjSSy8tLi7Oz8/HxcVhd8TkKyZHsfDLL78kJSWRAqlWSKVSZAWTCaGhoTKZrLOz8/Dhw3q9vqysTCaTra+vq1SqV155Ze/evc3NzVThTOph27FuweqM3ZwlmlyGw9zcHEEQVLEOOZzpYOAeIBbzEQKBQC6XNzY2Xr58uaGhIScnh0kUFocCTXA+Xdg1kOOJAuDCJjvObDZ7eHj09PSQIfHw4Dodp1Qqc3Nz7969y+fzp6amTp8+7Uo3V9TDdltbW+O+I6cVdsWBrsBlvz/88ENvb+/g4KBery8qKnrxxRc//fRTgiC24BEDLk9nsZggl8tVKtXY2JhCofDz80tISGhra8NOlDkB3S1fffWV62JdOc63EibzSTIzM+/cuZOdnd3d3d3Q0OD6Hh0aI865cbuG4bMJx+sdm7ky7KUuQiQS0SdPqJ0JyoVqY2MjulCdm5vj8XhkN7Va7e/vT588wXazqxJ1lUk9Gwn0biwzOY7aZf3vLMf4+Dhqp85ysDvQxbkypwNng1qtlkqlVqtVIpGo1WqmPWJ1wDqKRX+LxRIUFESazGIFkwmdnZ1JSUnp6ektLS1Wq7W2tragoCAkJESv19OFY9VjURvrFo5imaLJcTjYzJU1NjbanSujWsQ0YWXXUqZIkeZTMZvN+/bt++KLL958803UsrS05OHhQZ0EYxrFDgWa4+mCo0McGg4AC5ufYz744IPk5GT0v6aysvL69es2cgiCyMjImJqaGhwcTEhIKC8vRz9JJJLa2tqFhQWtVqtUKrGDCtvNrkrUVSb1TCYTj8fTarVM3bjkGI52ofaMjAylUjk+Pj44OBgXF2dXQ5Lc3Nz09HSdTjc4OPj888/X1NRg40JCmuZK4IaHh0+fPv3rr78aDAadTpebm6tQKKxW682bN5OSkgYGBqampvLz89va2rCa2OQYrKNsQkDS1tZ25MgRuii6FSwmSCQSiUSC7hxMTU2JxeKEhASscKx6TO1MbuEoliWaHIeDUqmkiiVdQd4jYbGIJcdgVaWHgMl8G7KyssRi8Y8//ki2JCUl5ebmzs7OarXa1NRUtOulpSUej6fRaCwWixOB5ni6YDLQZu92hyHAkc3PMWazubCwUCqVCoVCuVxO/kejbnvr1i2JROLv7//uu++Sd+bb2toSExP5fH5ISEhRURHToKJ3s6sSdZVFvfLycqFQWFdXh+1mN8dwtwu1z87OKhQKkUgUGRl569YtLhoiTCZTXl5eUFCQVCotLy9HQ4LuBCrItOrqaqcDt7a2Vl5eLpPJvLy8JBJJdnb27Oys1Wq1WCzXrl0LCgri8/lKpdJgMGA1sbmWwjrKJgQkxcXFpaWldFF0K1hMyMrKysjIIFcTExORTKzwyspKG/WY2pncwlGslTmaHIfD1NTUqVOnRCKRTCb7/PPP6cOByeHsN96ZAmQTAibzbWhsbBSJRFQ5o6OjJ0+eFIlEhw8frqmpISNYUlJCHgCOBprj6YIlFtS92x2GAEe45pjNgv1MvXtx0S6NRiORSDZRnx2LE46SyWRdXV1u0sdNwt2qs0M46vBndYQC2wU8LLEjUKvV0dHR263FDmVkZGTXCXerzgCwi4Acs23cuHEjLCwsPT19bGystLS0rKxsuzUCAADYZOCBvG0jLS2ttrZWKpVmZ2cXFBRcuHBhuzUCAADYZOznGCeK3tfX1x86dEggEBw6dMjmYfmIiIgnT544pqPjPHny5MqVKxEREQKB4ODBg7dv3yYLjpF9HLULK5P81a5d9Mrhx48f7+3tXV1dffz48ZUrV2xUelYrjW/NAQCQOOpwCBCwydi9Y+PoPcB79+5JpdLm5maDwXD//v2YmJitf+wPPRas0Wjm5uZUKlVaWlp3d7eV8kCn1XG7mGRyh6XkBlYlu/0BAAB2OHusVit7EpqYmDhy5Aj3vzbh4eHffvvtq6++ilYfPHiQmpo6Nzfn4+PjUjLkzNOnT8ViscFgIEvLYHHILo4yXcRRVwMAAOxw7MyV2VRcZ6pDTu0/NTVF/WDG0aNH79+/TzBU3mYpbE4vGM5eRZwElSSi1xeizj5xKebPRSbhtuL2VG1ZipwzfSAAAABgJ2Anx9hUXGeqQ05iMpn4fD75wQzECy+8gC5i6JW3mQRiC4azVxEn8fHxkcvl58+f//3338nPxrDbRdgr5c0ic2uK2zMVOWf6QAAAAMCOwO5sGnmTgEsdcpabHNjK5FiB2ILhdquIU1laWiopKZHJZDweLyYmBr0+zV4NyW4pb6xMq9uK29ssE7gi5ywfCAAAANgJOPB+DJeq8jwez2KxMEmgVybHCsQWDGeqIh4cHEwK/Pvvv9ECmqeqqKhYXV3t6+srKiqyWCy5ublMinEp5Y2VWVxcvDXF7bFFzpk+EAAAALBD2OR3MNFUz7///kudLuvt7XX09IctGI5tVKvVLHK8vb1TUlJqamqys7NZcoxDpbypMouLi4ktKW4PAACwG3Egx0gkEi8vrz///BP9cdZoNOQffxI/Pz+pVNrW1vbyyy+jlqGhoRMnTqCPKTkk8NixY8eOHSMIQi6XKxQK9J4NvfHAgQN0ycvLy9TH2MxmM8vVFUEQoaGhQqFwfn7+6NGjTH2wMv38/Pbt29ff3x8fH88i3waz2Tw5OYkuZbRa7XPPPcd9WyoSicTDw2NiYiIiIoIgCI1G45wcAAAAN2H/HcygoCCz2fz48WNPT8/z588XFhZOTk4ODQ2Vl5dnZWXR+5eVleXk5Pz8889Go7G9vT0zM7O0tBT74DKTwEePHr3++uu//fab0WicnJy8c+dOQkICthGr8MjISHR09Ndffz0zM7O4uNje3n7p0iX6RQxpF1rNzs6+dOnS0NDQzMxMVVXVjRs3OMosLCzMy8t7+PDh9PT05cuX29vb7bqUIIiioqLp6WlktUKhwKpkF09PT4VCUVhYODExgURx3BAAAGCL4HLThqy4zlSH3Ia6urrY2Fg+ny+Tydi/boIViC0YzrGKOKKlpSUtLU0sFguFwri4uHv37mEVYC/mz0Wm1W3F7Znu/1v/t8g50wcCAAAAdgL238EENhf3vWg5MjJy4sSJv/76a9MlAwAAOAfUxHx2gA8EAACw04Da/rsb+EAAAAA7GbiO2d3ABwIAANjJwP0YAAAAwF3AdQwAAADgLiDHAAAAAO4CcgwAAADgLiDHAAAAAO4CcgwAAADgLiDHAAAAAO4CcgwAAADgLiDHAAAAAO4CcgwAAADgLiDHAAAAAO4CcgwAAADgLiDHAAAAAO4CcgwAAADgLiDHAAAAAO4CcgwAAADgLv4DsCtJPq9KkIgAAAAASUVORK5CYII=)

Screenshot: strength.or.kr  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 17 September, 2020 17:47 GMT
Vulnerability Verified: 17 September, 2020 17:59 GMT
Website Operator Notified: 17 September, 2020 17:59 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 17 September, 2020 17:59 GMT
Vulnerability Fixed: 27 September, 2020 04:55 GMT