Lucene search

K
openbugbountyDevl00pOBB:1346070
HistorySep 18, 2020 - 8:03 a.m.

kobe-face.jp Cross Site Scripting vulnerability OBB-1346070

2020-09-1808:03:00
devl00p
www.openbugbounty.org
5

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: kobe-face.jp
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAWUElEQVR4nO2df0xT1xfAn13FUgoilIJSvyIzSJhjyJTopsaocYwQUp0/GGOIjiBjiErUITOOMYaKaBzZDHFsqYtxZFlIQwhzpjGuQ8YQm1orqwQNsloZ1g60YoXK+/5xs5u396uvhSrg+fxBet+7955zz72P03ve63lTSJIkAAAAAMAHiJ63AgAAAMCkBXwMAAAA4CvAxwAAAAC+AnwMAAAA4CvAxwAAAAC+AnwMAAAA4CvGhY+ZO3fu1atXuYovGuNq+ONKGU+Z0MoDrMCcTjiev4+5du3ayMjIa6+9xlp80RhXwx9XynjKhFYeYAXmdCLixsfcvn07MDCQ9dTAwMChQ4e4isJpaGhIS0ujFXnkeqqnR+zevdvf3//06dOj74qGQA1p1vC1OP76niozVrMwJrLGypIe4dFV4J25/vnnn61bt4aFhUVGRn788cfDw8Oe9kDTYcp/efvtt/HZX3/9deHChQEBAUuXLr127dpopKCR3r59e8aMGV73wzqnuM+xXX4PHz7cuXPnnDlz/P3958+ff+TIkadPn/LUp1ly9uzZ+/fvH+XsTBJIXrq7u2UymZBTPDX5SUpKOn/+PK3oaW9eS6dis9lEIpHBYHC5XKPsihWn0+m2Ds0aXuOFQZjqearMmMzCWMkaK0t6hEcW8M5caWlpGRkZFovFbDYvW7asuLjY0x6YOjgpDA0N4bMREREajcZut5eWli5atGiUUtCH4OBgr/thnVNqn0IuMYFs2LBBpVKZzea+vj6tVrty5cq2tjae+lRLDg4OGo3GJUuWHDhwYKz0mbg8Zx9jtVqDg4PxssbF5+JjnuW/SFZo1hgNox+LF8qMHx8zhpb0CF/7mMHBQaVS6XA4ULGtrW3evHmeqeiJDnK53GKxkCTZ2NgYHx/vtRSLxZKYmIg+JCUledcJ15yO0m+xMjg4KBaL+/v7hTdhWrK5uTk2NnZsFZuICLof8+WXX86dOzc0NPT9998fGBggCGJgYCAqKsrhcEyZMuX06dPU4vHjxwMDA48ePRoeHj5jxowtW7Y8fvyYq+eGhoa1a9dOnTqVtYi4fv16aGjob7/9hoqPHj3avn17WFjY7NmzP/vsM+oG9siRI0yhT548+eCDDwIDA+fMmfPpp59ybXjv379PHdHly5eXLl3q7+8fFha2cePGO3fuoGpPnz7dv39/eHh4QEDAxo0b79+/L1AE2sijv1zGwcNH1Q4dOhQWFjZz5sxvv/2WSwqqeezYsblz586YMeO9995DE8RjQJ5+uKaGyxr8sLaiCaIFOlgHwmpzBHNljtKSrFPDXHKs3dIuCtrUc0066xC4mvj7+//1118BAQGoWldX16xZs6imCwgI2Lx58/379/fu3RsWFhYaGrp169ZHjx7xTNPIyMjOnTvDw8PDw8N3795NXb35+fkpKSkfffRRSUnJ2bNnqa34B0UjMjLyypUr6MMff/yBDv7yyy88WjErUBfknTt33nrrrcDAwPnz52PF8NLavHnzF198gRsuXboUTYdwiSMjIwRBiMViZh2e1UhDIpE4nU5+iS8C7n2Mw+EwGAwtLS1tbW1Wq7W4uJggiOnTp5vNZrQ3zMzMpBbXrVvncDja2tra29vb29v1en1lZSVX56w3Y6gVBgYG1q9ff/jw4eXLl6MjhYWFVqtVr9efO3euoaHh5MmTWM/2f6EKLSsrQ1vXc+fO6XS6mpoaVk1CQ0OpI9Lr9bm5ub29vSaTSalUFhQUoGqVlZVarVar1XZ2ds6aNaujo0O4CKwnl3Gow3c4HGaz2WQyqdXqZcuW8UhxOBxGoxFNUE9PT0lJCb8BBWpLVYbLGvx42oprIKw2JzhW5igtyTo1rEuO2S3toqANjbVnniG4vYhu3LixZ8+eqqoq3E9zc7PBYLBarbGxsTabzWg0tra2dnd3Y0uGMSAIYnBwUCaTmUymlpYWrVZ74sQJLEImk926dUutVp87d+6VV15hzherhqxSmGRnZ69evRr5HhqXL19evXp1dnY29SB1TgsKCoKCgjo6OpqammjOjyCITZs2aTQa9Pnu3bsGg0GlUnkkMSAgICUlJT09/dKlSzQPzbUaaQwMDJSWlqakpLCefbHg3+Z0d3cTBPHgwQNUbGlpiY6OxqdYY2WoSU9PDzpeX1+PI7k9PT1RUVG4icPhkMlkdrudWcS9paSk5Ofn4yYulwute1RsaGhYsmQJv1C5XI5jCwaDgWerzhU36OrqioiIQJ8VCoVer6dVECICdc6jJ234BEFgy/BIoU1Qc3MzmiAuA/L0Qx07bWq4rME6RtZTuBVz2aBAB9dASA6b86zM0ViSOTWsS461Wy4LcPXMf3FxrROExWKJjo6uq6vDlXFgp7m5WSQSDQ4O4m5xPM3CwOl0tra24m41Gg1evbW1tfHx8b29vStXrkxOTiZJsqurS6FQuNWQKYVkw+FwVFRUhISEbNq0qbOzEx3s7OzctGlTSEhIRUUFniPyv3PqcrkkEglVNF5CyPiDg4NBQUGowsmTJ9PS0ryQ+ODBg+Li4piYGLFYPG/evNLSUnSblnU1YoPI/8XPzy8jI4Pa4QuLZ/djqKFPHh8jkUjw8Y6ODrwuXS6X1WrFp+rr61etWsVaRL2VlJSIRKLvvvsO17FarX5+frjY2dmJ/3OxCrXb7dSJDwkJQcflFFgHq9fr16xZM2vWLNQKjbq/v18sFtOeCOASwWpJHuMwhy9ECs+/bFYDCuyHNjWs1mDakNYJayt+hZnHWW3OU380lmSdGtYlx+VNuXwMa8/8FxfXOkEsWbKkurrarSmYRX7MZjPz65TVapXL5RUVFa2trQkJCQI1FIjdblepVGKxGBXFYrFKpWLeCKHOqdVqpYlmLqH09HRknzVr1pw5c8YLiRin09nS0oJu4HOtRiRdKpUin6pWqyMiIrCbf8FhCTj6jpdeemnmzJm4yB8oGxwcrK+vr6urKygoWL9+/fTp072Q6HQ6RSJRe3s7Dq2KRCKCIAwGA39DlUqVk5NTU1MjkUgsFktycjJ1FEJEeAr/s7ZeSGE1oMB+aMqwWmM0NvQUms35GXNLjjfu3r1rNBp///13Txsyw1b37t2jHUG3Iu7du2e32xcuXEgQxMyZM9VqtUqlam9vR1HB0UtB3Lx58+DBgzqdrqysDB0pKyurqqrKz88vKyt7+eWXcU1Pn0TftGnTV199lZmZ2dbWVl9f74VEzLRp05YuXVpdXZ2Zmblnzx6CezWKRKLIyEiCILZs2VJVVVVbW7tjxw7hOk9a+F2Qd/sYgrKJ1mg0rE89ulwuuVyOQxC0Ynd3t1gs7ujoIEkyNTW1oKAAVxMSK6MKlclkrHtbnsH29fXhrzkkSRoMBjxqhUJhMBhoDYWIYI2VYT2Zw2d+HWaVwrMtYDWgkH5oyvBYg6cTrlYPHjwQiUTUmBj/PobksDlX/dFYkmtqWGNlHu1jWHvmv7h4LiKXy4X14e+HVmRGsbRaLd6akCRZX1+PYmUoHoUDSiRJ5ubmEgRhMpncaigwVpaXlyeTyYqKimw2G/W4zWbbtWuXTCbLy8vD46X9r6DGyjQaDXMJOZ3OkJCQEydOrF+/3guJJEnSwlw6nQ5FMllXI8mYhbq6OqVSOYbPUk9cvPcxDodDLBbjVYiLaPFt2LDBYrGYTKaEhITS0lLcAza6TqdbsGABPk4rUuWazWaJRGI0GlExJycnLS2tp6fHZDIlJiaiHTGP0Ly8vCVLlphMJqvVWllZWVZWJmSwCoXi5MmT/f39nZ2dKpUKj7qioiIpKcloNFosloKCAp1OxyOCusKoPoapJ8/wMaxShISeaAZ02w9NGR5r0Hjw4IFYLDabzThyzdoqKSkpJyent7e3s7Nz2bJlbn0Mq8256o/GklxLiLnkuHwM9aLAs8/Vs1sfw3URkWxLi7UfZpFGf3+/XC4/ePCgzWbT6/ULFizAIbj8/Pw33njDZDLZbDa1Wi2XyyMiIvAPPtxq6JbMzMzu7m6us93d3ZmZmegzc0GqVCqqaNYllJGRERQU9OOPP3oh0Ww2KxSKU6dOWa3W/v5+pEBFRQXJsRqZ0kmSjIuLq6mpEWaMyYz3PoYkydLSUqlUqlarqcVjx47JZLLDhw8rFIrg4OCsrCwcl6T2tmfPnpKSEtwVrUiTW1hYuGLFCvTZ4XDk5ubK5XKlUolvxKH6lZWVTKFOp3PXrl1KpVIqlaakpFC/APIMVqfTLVq0SCKRREREFBUV4VG7XK59+/bJ5XKJRKJSqdAXIlYRrPs89JdpHP7h8wxE4O0NqgHd9kNThscaTIqLi/GS4GrV1dW1atUqmUwWFxdXXV3t1sew2pyr/igtybpumUuOy8eQ/70KqDowe3YbJGBVhmTzIqO5H4MiYDKZLDo6urKykmql4uLiqKgoiUSSmJh45syZW7duSaVSqo/n0nBsYS5Ii8Wydu1amUwWExNTVVXFuoQ0Go1MJvNaq6amppUrVwYFBUml0vj4+FOnTqHjrKuRKZ0kyTNnzkRFRT37H2mNN9z4GC/gufyoxMTEUB9ooRUnH1Qfwzw7roY/rpTxFK+VF7hun03PvlNmrHiWGk7oBQk803v+VG7cuMFTfNEYV8MfV8p4yoRWHmAF5nRCM8GeqOHi6tWrH374Ie3g+EkDPjw83NLSolQqn7HcuXPnXrly5d133/3777+FNxknRgMAYBIwSXxMdnZ2VFQU9ci4SgOem5tbUFBQUVHxLIUiC7z++ut+fn7omUuBTcaJ0QAAmAzwh9KoUVf0JAlCJBJFRUWVlZWhW+79/f3ooQtP8TqqS5WI8iXTHhMsLy+nPrDLQ19fX0ZGRkhIyKxZs3bt2oX6sdvtmZmZ6OC+ffuoN+6cTmd6ejpN7Vu3bqWlpQUHBysUipycHPSTrtHErJOTk/kfSqFOB4KaQ4GkWECv13P9Mp+GW6Op1erY2FiJRBIbG4sfQOLR0O3wvViTAABMINzsY+bMmWOz2XBR9m/yaofDodFoGhsb0Xdz9B/fKx/nJVSJDodDKpVOmzaNWkH4j7aysrIkEonJZNLpdEaj8cCBAwRBbNu2bWRkxGg0arVanU6HZT158iQ5OdnlctE6SU1NjY2NNZvNra2tNpstPz+fYFhPODdu3NDr9VlZWfzVZJSs7OXl5fHx8dSz2AIhISEOh0OIXH6jffPNNwcOHKiqqrJYLDU1NdXV1Z9//rmQbnlAypvN5uDgYDyWUfYJAMA4Qrg7Yn4tbW5ujouLYz3ldZ9eNGR2Ijy1u8PhkEgktGTpTqeTmtkbDxPJKi8vp0lk/t5QqVR6MShMfn6+2zdP9Pb2oixSiLi4uPr6elykWkCgkd0aTalUUt/eodfrpVIpT0Ym4ZPrUb4TAAAmEN6/B5MgCIlE4nK5mCnNWXNoC8kPz5N0nZpHnSuJOganAV+3bt3Ro0fRwatXr06bNg2nT9++ffvevXsDAgIeP36Mk6UPDQ35+fk5nc6RkRE/Pz88zMHBQfR5zpw5n3zyCU1cWFhYTEzM119/TRDE48ePa2pqUMoN6uv/hGdfHxgYQAlg+K0XHh7+888/47N9fX2pqalMCzCNg+HJnX758uXly5cHBgZGRka+8847f/7558DAgMViWblyJa6/cOHCixcvos+sue4xHuWBZyoGAMDExft7/vfu3Ttw4IBKpWKmNGfNoS0k0ztP0nVqHnWeJOoIHPNJTU3VarXoYGNj48jIyLlz51BRq9UyM2+Xl5dnZWVNnz49MTGxpKRkeHj44cOH6CWA/NZobGwsKSnx9/cPCgq6ePFibW0trYLA7OsEQdTW1qampoaHhwu3nlqtzsjIoHoU/qiX29zpqamp2dnZPT09zc3Ny5YtQ1s9iURCc1qLFy/G7pmZ6542fIGveyB4c7ADADDB4N/mMO/542y1EokkLy8P3SGnRUVYc2hT4cr0zpN0nZZHnSdWRk0DbrVapVIpUjIpKamoqCgjIwM1CQoKosWFSktL16xZg55i6OjoSEhI8PPzk0qlBEHQ3vDKjAIVFhYmJia2tbWdP39eqVTW1tZSq3ULzr5OkmR0dLTBYOAJH9Gy6zudzuDgYGoCLlpmfqq2QnKn2+12sVhMe4aCP/DFP0fd7jLV0wbrdv0AADBR8MzH4OTVVquVmuCa9R8QLYe220zvAtPOsypGrUDLS5+QkHDhwoXe3l6lUtnf369QKFwuV21tLTVZHkmSGo0mOjqaliyvv7//+PHjzJyeNIlDQ0NSqRQnBDt79iwt6aHwbB9YeVodVush6urqaO/BpVmAKl1I7nSSJNPT0xMSEoqKiqqqqi5evEiSpMVioSZU5zcI7WC3uzzwrA6Vtn4AAJiIeBYrQ8mrIyMjZ86cyZ9u/ebNmyhhHM6hrVKpVqxYodPpDAZDU1MTswlOum4wGAwGg9FodJs9nhVamCglJUWr1TY2Nqampk6fPj0hIUGn09ECZdevX8/Ly6uvrw8NDaV2JZVKT5w4cfDgQX6Jdrt9aGjo1VdfRcWEhASLxeKF5gRBVFdX79q1i3mcx3pqtXrbtm3UIzyBsrKyMp1Ol5+ff/PmTZ4mP/zwA3pF1dDQUFFR0Y4dO1Bkcnh4mNrqypUr/O/x9Rrm+gEAYELC74L4H99irUay5dDmyvROaygkfT2/YrQ04CRJtrS0JCUlpaWlNTU1kSR58uTJwsLCiIgI/LY0u90+b968s2fPMsd16tSpxMREt+MlSVIikXR1daHP9fX1+I0Dnu5jCIIICQlBmxWRSIS2dDzZ9dH2oq+vD59lWoAm3W3udBr4MTmlUqnVavFxk8mEnytzu48heF/3QDMIVw52AAAmHGPjY2h5/llzaLNmeqdlgxeSvp4psaenB4dimGnAkWiFQoFuMFgslqCgIPzODJfLtWbNmsLCQicFfCo6OrqhoYHfLIiCgoJVq1bdunVLr9fHxMSgxMNe+Bj8yo3W1tagoCD8+g2uPPmHDx9WqVRUTZgW6OrqYkaieHKnd3R0JCcnX7hwwWaz9fT05OTkpKamkiR56tQppVLZ2Nhos9l0Ol1cXFx5eTmXQUiGj+HJA08zCH8OdgAAJhBj42NIRp5/JlyZ3qnZ4IWkr2dKdDqd+H1KzDTgJElmZGRs2LABFxctWoTrMH8tjxX7/vvvWTcxrCo5nc6CggKFQvG///2vqqqKVs2L7Ou0g1zWi42N1Wg01IZMC/z000+0GzY0aE2GhoZKS0tjYmL8/PwUCkVmZmZvby86hX/nHxMTQ/2dv1sfw58HHn4fAwCTlUmSt6OwsBDdsh5XacCfS4Z2mgWcTmdUVBR6zk1gkzFn/GeqBwDAR0whOXJGTSyGh4cNBsPixYuftyL/4fbt2wsWLHj48OHzVePSpUtvvvnmc1RgnNgBAIBnzyTJuzx16tTx5mCeVz5/Js/XwQAA8CLz3N5RNunJzc1taGhg/uAfAADgxWGSxMoAAACAccgkiZUBAAAA4xDwMQAAAICvAB8DAAAA+ArwMQAAAICvAB8DAAAA+ArwMQAAAICvAB8DAAAA+ArwMQAAAICvAB8DAAAA+ArwMQAAAICvAB8DAAAA+ArwMQAAAICvAB8DAAAA+ArwMQAAAICvAB8DAAAA+Ir/A/fKGPNPm73wAAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAP1ElEQVR4nO2df0wb9RvHb11lLZTftGOsCCwEYVlwc0jAMCRTl1kJIZP9yKxuRoJmYYhEF8RfdZuDMTGRLbiQaRj/aPyjIWQxZCG6VCQLMtZBYaWQCQUKYwUpFFaw0O8f9/3e99L73Kd3LQfFPa+/2vK55/N+nnuOT3vXe3eTy+UiAAAAAEAAROstAAAAAPjXAmsMAAAAIBSwxgAAAABCAWsMAAAAIBSwxgAAAABCAWsMAAAAIBSwxgBrQUJCwr1799ZbxX/xKzF82dDigScQWGMAwenp6VlZWXn22WfXWwhB+JkYvmxo8cCTiec1ZhOK4ODgNRC3lthstsrKyvWa/YMPPpBKpdevX2eTNDw8vC415zgvvnrNzc15eXlrJgY/nq+Ytay8x7lWq5K84HVo+FKu9WpyQFhcnnA4HA6Hw2g0hoWFkY9NJpNMJvO44cZiaGhovZKyWq0ikUiv1zudTjZJ6yjP4XB4HIOXl56efvPmTd+VeFEEpni+Ytay8h7nWq1K8oJXBXwsF5dmAzYWYo+L0JYtWwiCkEgk1OOAgAChV74nCrvdHhgY6LcnQMid7jXj4+MmkyknJ2eV5PDDTfz6ivGRDS2eIz42G+CHeH895ttvv01ISIiMjHzzzTdtNhv1+uLi4jvvvBMcHBwXF/fFF18sLy/TtyI/Dl+6dGnr1q3h4eEnTpx4/Pgx+ac///wzMzNTKpXK5fLDhw+PjY2RgysrK+Vy+bZt277//nvkMCpsTU1NQkJCUFDQ0aNHp6amPvroI7lcHhkZ+fbbb8/Pz2Pk2Wy2+Ph4u92+adMm8oQVcxhSDJe86MzPz7/77rtyuTw2NvbLL79cXl6emppym5qEKYmt5viCU7Xdt29fcHDw9u3bX3/99fv37xMEsby8/PHHH2/dujUoKOjw4cNTU1PMHOmnL9hyREqlaG5uPnDgwFNPPYUsIFI8fW+Gh4e/8cYb9AYj6e3tjYyM/P333zFFYJ57ocSwNZJHMO1HjRkeHg4PD8cnwiw+tTnbkeV1JZFtyWxFajw9MtvOxTc8MgWPx4hbGZFNC2w4vFxj7Ha7Xq9vb2/v6OiwWCzl5eXUn86ePbuwsNDd3d3S0qLT6a5evcrctqOjo7Ozs7Ozs6urq7q6mny9q6urqKhoYmLCYDAolcri4mJysNFoNBgMDQ0NWVlZbMMoSW1tbXq93mKxJCcnW63W7u7u27dvDw0NVVRUYOSFhoYajUaZTOZwONRqNdswphguedEpKSmxWCxdXV0tLS3Nzc11dXWRkZFuU5MwJbHV3GPBCYLIzc09efKk2Wxua2vLysoiP5VWV1e3tra2traaTKaYmJi+vj7vcmRKpUO/hMAMzibebrd3d3eTyZrNZmr3kdhstkOHDlVVVe3bt497EdzEsDUSHr5bsSWCLD6BPbK8riSyLZmtiIyM2blskTEpcDlGKJBNC2w8OJ5TGxoaCgsLox4TBDE7O0s+bW9v37FjBzUyKirKbreTj/V6fXp6ulscgiDMZjP5VKvVpqWlMacbHByMjo4mB09PT7OpIodRYWdmZsjX29raRCLRwsICpTAxMREvz+08MnMYXgyXvJxOp0wme/DgAfm0ubk5IyODOTU9Jv16DFvN8QV3uVzT09NisZh5pluhUHR1dTGzoOfI1IDMkS0Fu90uk8nIgMgCIsW7JdvW1kYmS82iUqlOnTrFJQ5dFV2MG1QjMcFcYKC3H30MdbCwJeJCFZ85nr6Xfakkc5dhWpEZGVkBtsiYFDweI/SJ2JoW2HB4vh6DRCaTUZ9qY2Jipqenycd///231WqNj48nn66srIjF7lNIJJLY2FjycXJystlsJh/fvXv3zJkzfX19S0tLKysrKysr5ETkaQcK5DByZGhoKPlYqVSGhIRIpVJKodVq5SgPM4wphkteFJOTk0tLSwkJCdQY8qjjCLLmXDIKDw8vKCjIyMjYv39/TExMWlraiy++aLPZpqenU1NTmbP4kqMbN2/eTE9PpwK6BceIpyerVCqpBiMI4pNPPmlpabl27RqXOBgxyEaSy+XU+EePHjGDsLUfG8hE2IpPsB9ZXlcSucswrYhvADpszcCWAmYTJsim5aIK8De8XGPYcDgcIpGos7OTanGRiOvpuPz8/MLCwqtXr0okktHR0YMHD/oyzBd5yGFLS0vcJ1ozOGb0448/3rlzx2AwWCyWsrKyF1544fz58wRBbN68WVB5+O/aetEtCwsLWq32p59+Ki4uPnToEPmugmMcNzHIRtLr9XgBvrSfG7yKv+qV9H+YTXv58uX1FgXwZpXXmG3btgUGBk5PT+/Zs4dtjMPhGBkZId/OmEymp59+miCIR48eWSyWzz77jBxDfuxgwnGYL/LYhg0PD+ODI/Oio1AoAgIC/vrrL/L9o9FopN54eg3HjAiC2Lt37969ewmCUKlUubm5ly9fjoiIuHfvHq/vs3nMkc7y8vKNGzc+//xz38VTiEQirVabkpLS2Nj46aefkv90uMRxE8PWSNu3b8fMzrZVRETEwsLC3Nwc+f59dHQUn0VoaCiv4vtSSeQuW5VW5NUM3m3CbFq+IoF1Z/Xf7KjV6lOnTvX29o6Pj1+6dOncuXPMMWVlZWNjY729vRqNJjc3lyAIuVweERHx3Xff2Wy2gYEBjUaDDM5xmBfyoqKiHA7HwMAA9yy45EVn8+bNx44dKy0tHRkZIcccP34cE81NEt+MKO7fv//qq6/+9ttvU1NTIyMjV65c2b17N0EQpaWlRUVFPT09Y2Njp0+fpr6j5UWOSKnt7e3R0dHUCRnvxLshkUhSUlIIgvj666+vXbvW09PDMY6bGO6NFBER4XA4+vv7l5eX2bYKDg5OS0srKyt7+PDhwMAA/So3G7yK72MlmbuMVyvSd+7i4iL9T/iGR8JxE7amBTYeHK/buF3zR17hJHE4HKWlpUqlMjAwUKVSUdcV6dtWVVUpFIqwsLC33nqLujKv0+nS0tIkEkl0dHRZWVlYWBjyYiNzmEdJ9KcYeRqNJjAwsKGhATkMf3MZJi86dru9qKgoKipKqVRqNBrypktMZEoSJkF8wV0u19LSkkajSUpKCggIUCgUarV6YmLC5XI5nc4zZ85ERUVJJJL8/Hyr1cpUwrwPlC1HevVIPvzww4qKCmQoCqR4zCV0+uslJSXZ2dkc47iJcbE0EpLy8nIqNbatBgcH9+/fL5PJdu7cWVtb67EtmcXHjPexkshdxqsVyZ1bU1PjsRkwKXs8RujbsjUtsOHgusasFut4v7qg/FvzosM3x6SkpNu3bwunhxd+JYYvXosXri29iPwkHCMAk1W+HgMAFP39/est4f/4lRi+bGjxwBPOhv/yCQAAAOC3wBoDAAAACMVqrjFcrLnj4uLm5uZWfQovXMG9MPO/fv16SkqKVCpNSUlx+xqlj3lxZG5u7v3334+Li5NKpc8888zFixeZxlx882KLyQSZoxfm/2DhvmYI15ZeRF6bYwTwO1bx2s4aXNPjYrviYyg26uvrlUrljRs3rFbrrVu3EhMTz549y2tG3ykoKMjPzzcajZOTk62trTk5OR0dHeSfKNcNvnlhYnLEC/N/8AgBgCeETS6Xa7WWq+Hh4V27dgn6VoVtCi+m5rtJbGzsDz/88Morr5BP7969m5WVNTk5GRQUxH1SX3j8+HFISIjVaqUsc5DwyotjTN9Zg94AAMAP8XCu7OjRo1999RX1NDMz85tvvkHamLuBcTXHmJBzsfEnCOLixYt4C322WSiYjuVIq3P6+NHRUfpPd+zZs+fWrVtsytmiIe3KOXqYk9ZYSCcu6uwTlx8p4BiTEMz8n9oE0yTj4+OvvfZacHBwQkJCTU0NRwctAAD8DQ9rzJEjR5qamsjH4+Pjer3+wIEDHEOzuZpjTMi52Pjb7fbO/4GxB8ebvTMdy9msziltEomE/N0Riueff578EMNUzhYNaVfO0cM8KChIpVIdO3bsjz/+oH4Oxw2OP1LAMeYamP+zNUlxcXFAQMDg4GBra2tjYyMyWQAANgD4U2kLCwshISGkHXddXV1eXp7H+3ipxwSLqznGhNyjjT/GUdztIoRHx3v6JmxW58jBzDhuytmiIe3KeXmYz87OlpeXJyUlicXixMRE5O3ZHn+kgGNMl2Dm/9RjtiZxOp0SiYQqoFarxdyEDwCAP+PhHkypVKpSqZqamk6fPq3Vak+ePMl99UK6muPt3LnY+HOxB+do9k7h0XVfLBY7nU5MpnTlbNGQduUYD3Omzzx5nqqysnJxcbGrq6usrMzpdGI8vrjUgS3m2pj/I5tkcnJyZWWFXkB8EAAA/BbP9/kfOXLkypUrarW6o6NDq9XSfw3CC3iZkHvto77qVufkeZ5//vmHfrrszp07fP/9Ie3K2TzMMT7zW7ZsyczMrK2tVavVmDWGVx2QMYU2/wcA4N+N5zVGpVIVFhY2Nja+/PLL5FtOXjbmbnC3c2fzUediD87XNN6j1XloaKhSqdTpdC+99BL5Sm9vb3Z29uTkJN9oSLty5ItMn/n5+Xn619gcDgfm0xXHOrDF5Os/T23O1++diUKhEIlEw8PDcXFxBEEYjUYvggAA4BdwOaF2/PjxkJCQn3/+mXyanp5eWFg4MTFhMpmysrKoc+Wzs7NisdhoNDqdTsxlm/feey8jI4N8215dXU3eZYK84KFQKOrq6mZmZkwmU35+PunETBBEQUHB6OiowWDYvXu3RqNxmxozCx273S4Wi00mE/m0sLAwLy/PbDYbDIbnnnuutrbWbTz9/hidTrdz587z58+zKUdG6+vrO3jw4K+//mq1Ws1mc2FhYW5uLvJF5F4wGo0KhaK+vt5isczMzOh0ul27dl24cMFNg1te+DpgYrpcrgsXLqSnp3d3d4+OjhYXF+t0Oo/GzMi946aKfj2GrUnIu3aGhoYMBkNqaipcjwGADQqnNaapqUkmk1FG3EgbcxLKBZ2vFz1HG39yWHV1NdMenG7AzjaLG3Q7eqTVuRsNDQ3JyckSiSQpKYlahJDKkdGQduW8PMx/+eWXnJyckJCQwMDA1NTU+vp6pAb8jxRwjOkSzPyfyxozMTGRm5srk8ni4+OrqqpgjQGADcpq3oMJPOEIdKNlf39/dnb2w4cPVzcsAABrAHhiAv6OXq/fsWPHeqsAAMAb4PdjAH/k3LlzMTExeXl5Dx48qKiowPyUPQAA/gx8jgH8kZycnLq6OqVSqVarS0pKTpw4sd6KAADwBrgeAwAAAAgFfI4BAAAAhALWGAAAAEAoYI0BAAAAhALWGAAAAEAoYI0BAAAAhALWGAAAAEAoYI0BAAAAhALWGAAAAEAoYI0BAAAAhALWGAAAAEAoYI0BAAAAhALWGAAAAEAoYI0BAAAAhALWGAAAAEAoYI0BAAAAhOI/oIhFPowWvcMAAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 18 September, 2020 08:03 GMT
Vulnerability Verified: 18 September, 2020 08:18 GMT
Website Operator Notified: 18 September, 2020 08:18 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 18 September, 2020 08:18 GMT
Vulnerability Fixed: 24 September, 2020 21:52 GMT