Lucene search

K
openbugbountyDevl00pOBB:1351923
HistorySep 21, 2020 - 10:17 a.m.

ichosc.elte.hu Cross Site Scripting vulnerability OBB-1351923

2020-09-2110:17:00
devl00p
www.openbugbounty.org
5

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: ichosc.elte.hu
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAV4klEQVR4nO2df0xT1/vH77DCtRTkZwVaJ6JBwgxDggwdOuOIEkJMxR9jypQhQcYYOmIcMsIYI0gUnWMbMcwtzBk1i3GMEMJIZ1zn2KbY1VpZJWiwq5UpQ8CKtVTu54+T78nd/dVLpdDvfF5/9dx7fjznOefep/fce9/3OYqiCAAAAABwA17TbQAAAADwnwViDAAAAOAuIMYAAAAA7gJiDAAAAOAuIMYAAAAA7gJiDAAAAOAuPCLGzJ8//8qVK3xJgI7HOsdjDQMA8cA0nnSmP8ZcvXp1fHz8xRdf5EwCdDzWOR5rGACIB6axO3ASY27duuXn58e5a3h4eP/+/XxJ8bS0tKxbt46RFGjXqWFTAKP1CfX9aSxn+GrScblf7jYM4/I0mzKeZm6IrFMM9+/ff/PNN0NDQxUKxXvvvTc2NiZQya1btwIDAwVqu3fv3tatW4ODgxUKxbvvvvv48WO866efflqyZImvr++yZcuuXr06ISMnC9w1px0RZsqm8TOF69cxQ0NDNTU1fEnxcMaYefPmDQwMuGzbFONy3yfKFB8D4vs1ZYZNmasni+kyOCcnx26363S6c+fOdXZ2VlRUPM0xtW3bNpIkDQaDRqPR6/Xl5eV4V1ZWVmVlpdlsTktLy83NnSTzpweIMe5gmtfK7ty509PTs2rVKnbSx8dnGg3zQBi+8hw81rBnlkePHmm12sbGRoVCsWjRosOHD585c4Zw9Zh6+PDh+fPn6+vrw8PDFyxYUFtb29zcjPc6HI7ExMTAwMDExES73T5pfZgIEokkOjqa/sMFYBq7CVEx5pNPPpk/f35wcPAbb7wxPDxMEMTw8HBkZKTVan3uuee+/vprevLw4cN+fn4HDx6cM2dOYGDg9u3bHz16xFdzS0vLmjVrZs6cyUjSr+ufPHmyb9++OXPm+Pr6btq06Z9//hEwjCCIhw8f7ty5MzQ0dO7cuR9++OGTJ0/Q9kuXLq1YscLPz0+hUGzYsOHPP/8Urhzx+PHjHTt2+Pn5zZs374MPPsC1YRiuEFOEz3LGagbjwp/hnP3794eGhoaHh3/55ZcCjbJ7LdyKQL84HcgYRE5/co4Inxlo+6FDh+bPnx8YGLh161bsH4ZJbD98/vnna9euxXW+//7727dvZ3cNt+I5PqRbxXfssOcMX/5Zs2b99ddfvr6+qGBvb29ERATD5tu3b69du9bPz2/RokUnT57k9BLC19f30aNHuDa73e7t7Y33FhYWpqenv/3222VlZYx6OIdDwMnLli2bNWtWaGjopk2bbt++zTdMbBQKxeXLl9GP33//HW384YcfBDrFzkOfxpzGAK7hPMZYrVadTtfZ2Xnx4kWLxVJaWkoQxOzZs41Go0wms9ls2dnZ9OT69eutVuvFixe7urq6urq0Wu2BAwf4KudcKGPkOXDggFqtVqvVPT09ERER3d3dAoYRBFFcXGyxWLRabXt7e0tLS0NDA9qekZGRk5NjMpkuXLiQkpJCkqRA5ZiqqqrR0VG9Xt/e3q7RaI4ePcrIwHCFmCJ8lgtDd47VajUajQaDoampKSUlRaBRzl6Lgd0vvqrohnH6k29E+LBarXq9HvnHZDKVlZXxmcTwg0ql0mg0Dx48wIZlZmYKtOI5PqRbxXns8M0Zp8fa9evX9+zZU1dXx9heVFTk7+/f3d3d1tZGjw2hLBgFq6urt23bhpMymezmzZtNTU3t7e0vvPACPSfncPA5WavV5ufn9/f3GwwGpVJZVFSEO8gYJqcWInJycl599VUUe9hcunTp1VdfzcnJwVvo05jPGMAVKEH6+voIghgZGUHJzs7OqKgovEsmk9FzoiQqYjKZ0PazZ88mJiai3yaTKTIyEhexWq0ymWxwcJCdpFcul8u1Wq1IwxwOB5r0aHtLS0tycjJFUYODgxKJxGazMerhrJxOSEiI1WpFv3U6XVJSkkDfBYo4tZyz2oCAAE7nEASB/SbQKGevBVoR6BefAxmDyPYn34jwmcHwz4ULF7B/GKU4/ZCcnHzmzBmck22wQNnp8iHDKvaxwzdnBI41hNlsjoqKOn36NMMSh8NBkiS9ILbfzIJeYWVlZWpqqsPhQMljx47FxcX19/evWrUqLS2Noqje3l65XI7zs4dD+OhA9Pb2hoWFUTzDJGwhxmq11tTUBAUFbd68uaenB2/v6enZvHlzUFBQTU0NtoQxjTmNAVxD4jQIyWQyfIkdERExODjotAhJknPnzkW/Y2JiTCYTLt7Z2YmzdXR0JCUl4UUGRhIxPDw8ODgYFxcn0rC7d+/a7fb58+fj1tE0DQwM3LhxY3Jy8urVqyMiIhITE1955RWByhH3798fGBiIjIxEyfHxcYnEicfEFHHBpQznyGQyuqP4GuXstdO2OOGrim4Ypz/5RkQAun+USqWAfxh+IAhCpVK1trZu2LChtbU1PT1d4A6E5/iQDt+xwzdn+PIjNm7cuHv37tdee43Ryt27dwmCoBfEuxQKBZ/933///fHjxy9evDhjxgy0paysrL29fc6cOSdPnoyLi9u/fz/qGi7CGI7R0VG+o+OPP/7Yu3dvd3e33W4fHx8fHx/HHWcMsYCFdHx9ffft21dQUJCbmxsbGzs2Noa2x8bGZmRk3Lx5c/bs2Tgz4/jiMwZwAecxZhKZMWNGeHg4TopZKMMFn771U6dOXb582WAwWCyWkpKS5cuXV1dXC1dus9m8vLy6urrwkeDl5WR10YUiYhB+4kWgUXav9+zZ45oN7Ko+/fRTtmGTMlguk5mZiVZUWltb6SshTplGH7pWlVPu3Lmj1+t//fXXCZViLz3du3ePIIhr164VFBS0t7cHBwfj7YODg0uWLCEIIjw8vKmpSaVSdXV1If8jGMMh4GSVSpWXl3f06FGSJNFTahO1kM2NGzcqKio0Gk1VVRXeWFVVVVdXV1hYWFVVtWDBArSRMY3FGwM4R/gyx4U1Acb1e3NzM+P6HeFwOEJCQvASCiPJWCvT6XQiDeNbmWGg0+mUSiVf5XRkMhnnSp3AWhlnEaeWUxQ1MjLi5eVFXybCneJzjshGEajXfK047Re7KoZhFJc/+UaEzwwB/1CstTJO8xYvXqxWqwMCAnDlbDzHhwyrOI8d4XVFvmPN4XDQh0Zgray5uVl4rWxwcHDhwoUnT56kW4sqoS9D5efnEwRhMBjo2RjDwenku3fvSiQSumc4J4OAhWwKCgpkMllJScnAwABj18DAwO7du2UyWUFBAcU6vviMAVzD9RhjtVolEgmeYTiJ5v3GjRvNZrPBYIiPj6+srMQ14MVojUazePFivJ2RpLdbU1OTlJSk1+vNZnNRUZFGoxE2LC8vb926dSaTyWAwJCQk1NfXUxTV3d2dlpZ27ty5gYEBk8mUl5eXkZHBVzl9xbygoCA5ORn98Txw4EBVVRVFUSMjIxKJxGg0ooVphis4i+Bqhc+hSUlJeXl5/f39PT09KSkpaJeAc4Tt5Os1ZyvC/eKsimEYnz85R4TPDGH/0E3iO31XVFTExcWhnvLhOT6kaPON79gRjjF8xxr175nMqESlUtELCpxGHQ5HampqcXGxjQbaVVhYuHz5coPBMDAw0NTUFBISEhYWVl5eLjAcfEeHXC5vaGgYGhrq6elRqVQCMUYk2dnZfX19Ahn6+vqys7Mp1vHFZwzgGq7HGIqiKisrpVJpU1MTPXno0CGZTFZbWyuXywMCArZt2zY6Osqubc+ePWVlZbgqRpLxn2vv3r0hISEkSapUKvSvRDj45efnh4SEKJXKyspKdKjb7fbKysro6Ghvb2+5XJ6dnd3f389ZOaNmm822e/dupVIplUrT09Pxn53S0lJ231GSswj9Ok/Apb29vatXr5bJZLGxsfX19WiXgHOE7eTrNWcrwv3irIphGN9gcY4InxnC/qGbxHcC0ul0BEHgLnDiOT5kX5mxjx2BGMN3rLFdx6jEbDavWbNGJpNFR0fX1dUJnEbZ989wZpvNVlpaGhkZSZJkQkLCiRMnbt68KZVK0X8LzuHgO6A0Gk1iYiJJkmFhYSUlJU8fY8TDnsacxgCu4STGuIDIaREdHf3bb7/xJQE6HusczzTMarWSJMn5jJCHM9FT6tScgp8Szx8Oz5zG/xmm9J4/nevXrwskAToe6xzPNKyjoyMlJeVpdKuAScTzh8Mzp/F/hunXXf5/zZUrV956663ptmI6GRsbe/311//++2+R+d2tnT48PPzZZ59t3rwZJdnv6yHwi4GAW2EMB/AMMm3XMf8NcnJysrKyptuK6WTmzJne3t579uz55ptvnGaeAu10uVyekZGBX0RHNwPYTKNo9zMFYziAZ5FJXHcbGRkpLi5+/vnnSZKMjo6ura3Fd3c5YdxLVCqVpaWldrud4nqdG+Hl5RUZGVlVVYVrRrq2EzXV5YVsenMDAwNeXl6cT4tNIsI1C+wdHBzMzs4OCgqKiIjYu3cv27EiMRqNaWlp/v7+crk8Nzd3aGiIUYlWqxX5InR1dXVRUZFAhqamppiYGJIkY2Ji8ONnfIjpi7vnPAAAwkzmWllubq7JZOro6DCZTA0NDe3t7VqtVrgIkpew2Wyjo6NtbW3nz59Hb0sxdMhxNqvV2tzc3NraivXSp1g7nd6c1WqVSqXu1od2WZI9Nzd3fHxcr9er1WqNRuOyl9LT05VKpdFo1Gq1NputoKCAkSEoKMhqtYqpSvhN0i+++KK8vLyurs5sNh89erS+vv6jjz5yzWYMmjZGozEgIAA/d/uUdQIAMAEmK1iNjo5KJJKhoSHxRdj/Qy9cuBATEyMmW2xsLN9e15p2oSD9t9lsTkhIcKHCp4SvIzabjT4c2GMT7bjNZjty5Ah+2VCv1yuVSkZnRdZpsVgCAgLQ5RQnSqWyo6MDJ7VarVQqxYpSbMT3hf0ANAAAU4Pz6xinEtkoA5L04ZPzciqhjyBJEv3NFP7wH0mSDoeDYGmn85kqRqmbLTnO1hVnS7VjsLo4QRDr168/ePAg+n3lyhUfHx+sTr9z587U1FRO/Xk+F2FXIDF2X1/fBQsWfPzxx/QHddiq7zabbXx8HGuwkyQ5OjrK6PK1a9eCg4N//vlnlORU4Pfx8dm1axcyYGxs7MSJE6tXr6Z3VgDGcDC00xkS98PDw2azmf71jiVLlpw/f57uBD6Nd2FJfKeGAQDgPpzHGAGJbLo+tq+vb3p6elZW1i+//PLw4UNGTqcS+gRBDA8PV1ZWpqenC9tz79698vJylUpFsLTT+UwVo9TNKTnO0BVnS7VzkpGRoVar0e/W1tbx8fH29naUVKvVO3fu5NSfd+oiJMZuNBo7Ojqamprwdr6PLyQkJJSVlY2NjT148KCysjIxMZHh7czMzNra2hUrVqAtwgr83333nVQqvXjxYmNjI1/HMWzhdOLfC2VsiXv0FgX+khBi6dKl+LMlbI13OuI/J0E4U30HAGAycXqlwymRzamPPTIyUlpaGh0dLZFIFi5cSH+jW0CfP+T/8Pb23rJlC6qNfc8f5QkKCiJJsqCggC6/gXPyqXnTQUrd7GUWtuQ4p664GL0si8UilUqRhUlJSSUlJVu2bEH5/f397XY7p/4831cGUB4+MXY+1XeKorq7u+Pj4729vaVSKUEQaBkK25yenl5YWIhbcarzNjo6iiQ3jh49ymkh+s05Mah/a6eLUctnNyEwFk4l7tmCNE7nCQAAk4LY+zGDg4MqlQpLxUkkEpVKxXf3xWazdXZ2JicnI+WioaEhiUTCfsasr69PKpUiVbumpqawsDBO1Rl6NovFwqiHfW5imEpRlFarTU1NjYiIQFEqICCAUQoppeNoFxQUJJfLOc96YmIMRVHx8fHnzp3r7+9XKpVDQ0NyudzhcBw7diwzM5OiqNra2pycHIqi0KsDAi7CrVgsFpIk8cbu7m6RyitDQ0OHDx/G51yUv6yszMvL66uvvsLZLBaLt7c3Tvb09HA+KtbW1sa+7US3gW9inD17dvXq1TiZlZUVHx9fUlJSV1d3/vx5iqLMZjO9gwJNsDf29fUxnEP/hAnFcz+GPU8AAJh0RD1XduPGDaRviCWyq6qqNBpNYWHhjRs32Pl9fHyWLVtWX1//7bff4o2cku9eXl4KhUKhUGzfvj0kJOTYsWOcBuBs4eHhwtLxbFMJglCpVCtXrtRoNDqdrq2tjV0KS47rdDqdTqfX6/neqxBJenq6Wq1ubW3NyMiYPXt2fHy8RqNRq9VoJTAzMxOZ0draSv9QoztU8aVS6ZEjRyoqKvCW0dHRs2fPnj59urS0FN8o4mNsbOzSpUs4GRUVZbFYBPLzTQzGE2WnTp1Cn7ey2+0lJSXvvPMOup7DH/lAXL58mb3uOilwzhMAACYfp1GITyKboY9NURTjESCNRoPXbcTo858+fVqpVLJfNxH/gginqZxK3ew62ZLjT3Md09nZmZSUtG7dura2NoqiGhoaiouLw8LCLBYLysDWn+f7ygDnWhkWY3d6HdPY2Mh4BkwikXR3d1MUlZGRgd9W4VsrQ8+n4UWqlpYW9ocLGTawJwb7EwB0sMS9UqlUq9V4u8FgwM+VOb2OIQQ/J8Fwi4DqOwAAk4vzGCMskY31sY1Go1wub2xstFgsQ0NDaO0ev64oRp+foqjY2Fi03C8+xtC10/lMZSt1MwTYKS7Jcc526c2ZTCaB5R25XC6Xy1HINJvN/v7+8fHxeC9bf57TRfTuc4qxC8cYh8MRFRXV0tJCz4DzG41GkiT1ej1K8inwZ2RkZGVlmc1mnU4XGxvb0NDA6Glvby97JQpPDIqlnc4ncd/Y2KhUKltbWwcGBjQaTWxsbHV1Ndtsdl+cStwz3OJU9R0AgMliMt95bmtrW7Vqlb+/v1QqjYuLa2xsxLvE6PNTFHXixInIyEi73S4+xlCsTwyw4VTqZgiwsyXH+drFzdlsNsY3muhs2bJl48aNOJmYmEjXD2frz3O6iN59JMYulUqjoqKwGLtwjDl+/Djj9gkjf3Fx8cqVK9FvPgX+u3fvZmVlBQQEKJVKfNKnc+bMmbi4OE4nIBja6Xxq+RTtPf/o6Gj6e/5OY4yAxD3bLQAATBnPUTx6G4AYdu3aZTAYfvzxx4kWfPjwYUhIiMVicapHe+vWrcWLFzM0HG/duhUfH3///v2JtjvpPH78OCYmpry8fMeOHXx5Fi1adPz48ZdeeslNNnC6CAAATwA0MZ+Kuro6154O8HzBc5H4+PicOHHi5ZdfFsgD2ukA8MwC2v5PxcyZM5cuXTrRUuIFz8fGxjo7O5VKpUvWTRHCAQYAgGcZiDHTAL5t4DRnfn5+UVHRVIp+AgAATCJwPwYAAABwF3AdAwAAALgLiDEAAACAu4AYAwAAALgLiDEAAACAu4AYAwAAALgLiDEAAACAu4AYAwAAALgLiDEAAACAu4AYAwAAALgLiDEAAACAu4AYAwAAALgLiDEAAACAu4AYAwAAALgLiDEAAACAu4AYAwAAALiL/wH7zmaOFnSM/AAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQPklEQVR4nO2df0xbVdjH77oKBcrvtmOsbLAQJAthm0MEUyeZOmdtSMPYRmYdMxI0hhEkuiBGrdscyDITEXEh0SD/mBhDCCFmIUSXisQgYx0rWykE+VlYVxBYYQULff+4ee9733vPub0t/cX2fP66t5zznO95zqFPz7n3Pneb0+kkAAAAAMAHCAItAAAAAHhsgRgDAAAA+AqIMQAAAICvgBgDAAAA+AqIMQAAAICvgBgDAAAA+AqIMUCwk5KScvv27UCrQBC0wgAgeIAYAwQ1d+7c2djY2L9/f6CFMAlaYQAQVLiOMdtQREZG+kGcP1lcXKypqQm0Ck94//33w8LCfvzxR/qH9O6Mj48Harz4NM3t+fb29vz8fG/r+j8YCvlPA18Lowj+memxD/nb9FtdwPs4XWG32+12u9FojImJIY9NJpNYLHZZcWsxNja2FTtltVoFAoFer3c4HPTP6d0JbNfsdjt3AW552dnZnZ2d3haFbZ2/r3wtjCL4Z6bHPuRv011czjrAbwhdBqHQ0FCCIEQiEXUcEhLi68gH8MRms4WHhwfzjg05ZzxjZmbGZDLl5eV5T453CFphAMlmZh3gXTy/HvP111+npKTEx8e/+eabi4uL1Oerq6tvv/12ZGTknj17Pvvss/X1dXotchl75cqVHTt2xMbGFhcXP3r0iPzT33//nZubGxYWJpVKT5w4MT09TRauqamRSqU7d+78/vvvkcUos1evXk1JSYmIiDh16tTc3NyHH34olUrj4+Pfeuut5eVlDnmLi4vJyck2m23btm3kphO7GFIMxbfffvvqq69Spx9//HFxcTGuOY4u4OwTBLG8vPzOO+9IpdKkpKTPP/98fX19bm6OIZuE3R2Px4tU+8ILL0RGRu7atev48eP37t0jCGJ9ff2jjz7asWNHRETEiRMn5ubmkPqpXQvcuCOlUrS3tx89evSpp57COQfnXrZgxv7J+Ph4bGwsozm2GKQpujCkK3DjxaGBPoFjY2PfeOMNcowYkth+wE08JEg3BsqHdEnILwQCM2m5q7B1cgsAfI2HMcZms+n1+p6ent7eXrPZXFVVRf3pwoULKysrAwMD169f1+l0165dY9ft7e3t6+vr6+vr7++vq6sjP+/v7y8tLZ2dnTUYDHK5vKysjCxsNBoNBkNzc7NCocAVoyR1d3fr9Xqz2Zyenm61WgcGBv7666+xsbHq6moOedHR0UajUSwW2+12jUaDK8YWQ6FWq3U63cOHD8nT9vb2goICnB2OLuDsEwRRXl5uNpv7+/uvX7/e3t7e2NgYHx/PkE3C7s5mxkulUp09e3ZiYqK7u1uhUJAr2rq6uq6urq6uLpPJlJiYePfuXZf6kePOlkqHfs0DaRwpHimYD2wxOFN0YUhXIMeLu3WbzTYwMECO0cTEBDljkUNJ9wNu4nG0wnBjoHxIl4T8QuCYtLgqSDzuC+AdeO6pjY2NxcTEUMcEQSwtLZGnPT09e/fupUpKJBKbzUYe6/X67Oxshh2CICYmJsjT1tbWrKwsdnMjIyMJCQlk4fn5eZwqshhldmFhgfy8u7tbIBCsrKxQClNTU7nlMfZ/2cVcisnJyfnll18oU+SOMLc32F3A2Xc4HGKxeHR0lDxtb2/Pyclhy6ZgXI/xeLzm5+eFQiF7d1smk/X39zNaZOunZHCMO64LNptNLBaTBnHOYYvHCWZfMyDnM8e1BJwpujCkK5yY8cJpcLLGqLu7mxoj9lAy/ICceEiQ1QPiQ4Yk9sTgmLQuv0PcEgD4GtfXY5CIxWJqNZqYmDg/P08e//vvv1arNTk5mTzd2NgQCplNiESipKQk8jg9PX1iYoI8vnXr1vnz5+/evbu2traxsbGxsUE2xFiPI4uRJaOjo8ljuVweFRUVFhZGKbRarTzlcRRji6GjVqs7OjqOHz/e0dGhVCpDQ0Nxdji6gLNvsVjW1tZSUlIov5H/aTzxeLxiY2MLCwtzcnKOHDmSmJiYlZX14osvLi4uzs/PZ2Zmslvh8A9u3HF0dnZmZ2dTBtnGkeKRgrkbwoEzRReGc4UH40UfI7lcTo0RuxjDD+yJx90KvXqgfEgHNzFwk5ajimcCAJ/iYYzBYbfbBQJBX18f9VUlEPDdjlOr1SUlJdeuXROJRFNTU8eOHdtMsc3IQxZbW1vjNl5QUEBuPnR0dJw9e5ajuc10wbvwcchPP/108+ZNg8FgNpsrKyuff/75S5cuEQSxfft2n2pzeXMwTjxb8DfffOOZBqQptjBfu4Ib9sTjT6B86JmpLSrgSYfneoexrsct+Z1Op1gsZm8d0AsTtHVuW1sbuc61WCxCoZAqptfrY2Ji2LsoyGIuJdFPcfIYFtjF+NxMmZGR0dXVFRMTQ63x2XZ4doHBJvfKPB4vBnq9Xi6XO51OmUym1+txLbI/xI07rqLD4ZBIJFR/cd10KZ4SvLS0JBAI6JtRLvd5kKYYwpwoVzgx44XTgJSB/BNOHnviIUFW978PGZKQE8PlviJyLnkgAPA13n/OX6PRvPfee4ODgzMzM1euXLl48SK7TGVl5fT09ODgoFarValUBEFIpdK4uLjvvvtucXFxeHhYq9UijfMs5oE8iURit9uHh4f594JNQUFBZWWlQqGg1vhsO551Yfv27UVFRRUVFZOTk6TfTp8+zVGe0R0OuHt6796911577ffff5+bm5ucnGxoaDhw4ABBEBUVFaWlpXfu3Jmenj537twff/zBpxfsccdJ7enpSUhIoPaa+IvHCY6MjMzKyqqsrLx///7w8DB1ATkuLs5utw8NDZH3U9HFIE2xhSFdgRwvnAZu+Awle+Lxx/8+JAhidXWVrgE5MbjhWQUnAPAfPGMR/3WM3W6vqKiQy+Xh4eFKpZL+i4+qW1tbK5PJYmJizpw5Q12Z1+l0WVlZIpEoISGhsrISuY5BFnMpiX7KIU+r1YaHhzc3NyOL8VnH6PV6giBICxzN8ekCG5vNVlpaKpFI5HK5VqslH7rkqEV1ZzPjtba2ptVq09LSQkJCZDKZRqOZnZ11Op0Oh+P8+fMSiUQkEqnVaqvV6nIdgxt35//3PMkHH3xQXV3NtsOALR4n2Ol0joyMHDlyRCwW79u3r76+nnJCVVUVvXVKDNIUQxjSFRzjhdPAPUa4oaRgTzwkyOr+9yF7ZcaeGC4Xdri5xKjL0RfAP2xzOp3+DGnj4+MZGRnUrZaPGcvLyxKJxGw2c1z6fjJxd9yffvrplpaW5557zqeqPCA4hW3diefBF8Lj/R3y+OHla/5POJ2dnQqFYsv9nwchQ0NDgZaAJjiFwcQDghaIMV5jcXGxoaGhqKgo0EKAJwv2xJNKpciSo6OjkCwS8DMQY7yGTCZTqVRnzpwJtBDgyYI98cjLM2wgwAABwIvXdvyQIJbPrbo8WVhYuHz5sltVmpub09PTRSJRenp6fX29W3W9wtLSUnl5+e7du0UiUVpaWm1tLfvKv7v9wtnkCU/P01UFfyJhAAC8xZMbY9yt0tTUJJfLOzo6rFbrjRs3UlNTL1y44FaLm6ewsFCtVhuNRovF0tXVlZeX19vbS/6Jypbhbr84bPKET6IOhirI7QEATwjevK/MD/d74Jrww90pSUlJP/zwwyuvvEKe3rp1S6FQWCyWiIgI/o1uhkePHkVFRVmtViplDhK3+sXT5uaBe4EA4MnExTOYp06d+uKLL6jT3Nzcr776ymV+bwKfq5zA5BLnn8afIIgvv/wSl9abgjtlPTsDOTsTO6P81NQU/X0hBw8evHHjBk45zhoyzTjP3ONkWjNkgjUqmTmflxTwtEnwS+BPz6POM4E/I+E/cpLMzMy8/vrrkZGRKSkpV69ehTumAGCL4iLGnDx5sq2tjTyemZnR6/VHjx7laRqZq5zAJ5PnmcbfZrP1/S8cab25U9azM5BzZ2K32WwikYh8XwjFs88+Sy5i2Mpx1pBpxnnmHo+IiFAqlUVFRX/++Sf1OhwGPF9SwNOmHxL44yZJWVlZSEjIyMhIV1dXS0sLsrMAAGwBuLfSVlZWoqKiyNRAjY2N+fn5/BMrEZhc5chk8jzT+HNkAmdchHCZVJ9eBZcNDFmYbYehHGcNmWbcrdzjS0tLVVVVaWlpQqEwNTUV+bS/y5cU8LTp5JfAnz3oLhP4M5KYsSeJw+EQiUSUA1tbW+kPvQMAsIVwce9yWFiYUqlsa2s7d+5ca2urW1ldkbnKOZLJ80zjzyetN88c/hQuM7ELhUKHw8HRU7pynDVkmnGO3OP0pxwePHhAEAS5T1VTU7O6utrf319ZWelwODhyqfHxA86mfxL4IyeJxWLZ2NigO5DbCAAAQYvr52NOnjzZ0NCg0Wh6e3tbW1txr7XgiVvJ/z3Ogb+ZVwwgIfd5/vvvP/p22c2bN939+kOmGcflHsc95UAQRGhoaG5ubn19vUaj4YgxbvkBaTOwWesBANjquI4xSqWypKSkpaXl5ZdfJn9yrqysPHz4kDyemppyq72dO3eGh4fPz88fPHiQu+SDBw/MZvMnn3xCnpIvGSMIwm63T05Okj+WTSbT7t27N9MKiUwmCwkJ+eeff8jfzkajkfrtTxIdHS2Xy3U63UsvvUR+Mjg4ePjwYYvF4q61Q4cOHTp0iCAIpVKpUqnIcIL8cNeuXQzLy8vL9NvY7HY7x+qKpx9wNqOjo+Pi4m7fvr1//36OJhjwGR2XyGQygUAwPj6+Z88egiCMRqMHRgAACAr4bKidPn06Kirq559/Jk+zs7NLSkpmZ2dNJpNCoaD2ypeWloRCodFodDgcHJdt3n333ZycHPJne11dHfmUCfKCh0wma2xsXFhYMJlMarWazMRMEERhYeHU1JTBYDhw4IBWq2U0zdEKHZvNJhQKTSYTeVpSUpKfnz8xMWEwGJ555hn2I5b052N0Ot2+ffsuXbqEU460dvfu3WPHjv32229Wq3ViYqKkpESlUiE/RI6C0WiUyWRNTU1ms3lhYUGn02VkZJAPNtI1MPrF7QcOm06n8/Lly9nZ2QMDA1NTU2VlZTqdjt1Z9vUY9ugwVDGSMdNNUZOEfGpnbGzMYDBkZmbC9RgA2KLwijFtbW1isZhKoI3L7+2kpfjm+PpAJpPnmcafLFZXV8dO683ILs6dsp6EnlIemYmdAfWcf1paGhWEkMqR1pBpxt3KPf7rr7/m5eVFRUWFh4dnZmY2NTUhNXC/pICnTSe/BP588rQzVPGJMbOzsyqVSiwWJycn19bWQowBgC2Kv3P7A48xPnrQcmho6PDhw/fv3/euWQAA/ID334MJAN5Fr9fv3bs30CoAAPAEyLsMBCMXL15MTEzMz88fHR2trq7+9NNPA60IAABPgHUMEIzk5eU1NjbK5XKNRlNeXl5cXBxoRQAAeAJcjwEAAAB8BaxjAAAAAF8BMQYAAADwFRBjAAAAAF8BMQYAAADwFRBjAAAAAF8BMQYAAADwFRBjAAAAAF8BMQYAAADwFRBjAAAAAF8BMQYAAADwFRBjAAAAAF8BMQYAAADwFRBjAAAAAF8BMQYAAADwFRBjAAAAAF/xP0G/B9kSV/bvAAAAAElFTkSuQmCC)

Screenshot: ichosc.elte.hu  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 21 September, 2020 10:17 GMT
Vulnerability Verified: 21 September, 2020 10:31 GMT
Website Operator Notified: 21 September, 2020 10:31 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 21 September, 2020 10:31 GMT
Vulnerability Fixed: 9 October, 2020 03:50 GMT