Lucene search

K
openbugbountyDevl00pOBB:1360834
HistorySep 24, 2020 - 7:46 a.m.

gossi.co.kr Cross Site Scripting vulnerability OBB-1360834

2020-09-2407:46:00
devl00p
www.openbugbounty.org
8

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: gossi.co.kr
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAfjklEQVR4nO2dfVAbx9nAL4qCZSEwFrL4sGwLQimhLsE2odQlLoM9LiEaqlLqEEowoR5CKKGEoS4hGUpdD2Eo9iTY8bgeMkNSj810PNRlGJfxaDwMpZQSYBSqUIViKoiqUCxjRBQiE5l7/9hm3+197J0OxJf395du7/bZZ5/9eHR7d88+QtM0RSAQCASCH5CttQIEAoFA2LQQH0MgEAgEf0F8DIFAIBD8BfExBAKBQPAXxMcQCAQCwV8QH0MgEAgEf7EufExUVNSHH37Id7gpWX4d19ZKD0MbbWJI8xFWjbX3MX//+9+XlpaefPJJzsNNyfLruLZWehjaaBNDmo+wmgj4mMnJyaCgIM5TLpfrzTff5DsUT0dHR1ZWFt/hioOp0apJ46zj5OTk9u3bRcoEEla2LuKB+t+5c+fHP/5xaGjozp07X3311fv374ML7t69+8ILL+zYsWPnzp2vvfbal19+CfPev3//+eefR9WWIATwzDPP/Pa3v5UgZHJy8pH/5ZlnnuGsKWphQWu/9957TzzxxNatW5944olz585xCoEpgm3NUHLXrl0MI5w7d+7xxx/fsmXLvn37/vSnP6F5Maeote48GCSodO/evRdffBG07y9+8Qt2J/ErsB0lZBTfrzY8NBabzaZSqcScwlyJJzk5+ebNm3yH/sDj8ayUKGm15qyjzWYLCQkBvwU1BBIk23yZQP0zMjKKioocDsf4+Hh6enpVVRW4IDMzMy8vz263W63WlJSUN954A6R7PJ60tLScnBxUbV+FAKxWq1arXVhYkCAE2M2DsLi4yFlT1MJ4a1+6dEmn03V2djqdzu7u7piYmFOnTvFlhG0tOL6AegsLCyMjI6gRmpub9Xr9rVu3ZmZm2tra1Gp1T0+P4CnA2nYeDBJUysrKgu2bmppaXV3tJ904QcesrxnRmq7gjLQOWWMf43A4QkJC4AhnHK5/JNSar47i+yuUsCbTBCzd7XYrFAq32w3SBwYGYmJiaJp2u90ymWxubg6k9/b2xsbGgt82m+306dOo2hKEAEpLS+GE66sQ8XYT72N0Oh36v2F4eFipVAKVluNj0JTe3t64uDjwOzIy8tatW/DUW2+9lZWVJXiKXuvOg8dXlRYWFnQ6HbvdV42V8jGbG1HPY95+++2oqKjQ0NAXXnjB5XJRFOVyufR6vdvtfuSRR9577z308OzZs0FBQb/5zW/CwsK2b99+/PjxL774gk9yR0fH0aNHH3vsMfbhp59++uyzzwYFBUVFRZ05cwbek37++ecvvfTSjh07du3a9atf/erBgwcg/YMPPnj66aeDgoJ27tz5wx/+8B//+AdnIubO9MGDB6+99lpYWFhgYOCPfvSju3fvYopj89FHH4WGhv75z3+mvrr/ffPNN3fs2BEREfHuu+9yVvnf//739773vaCgoK9//etXrlwBF0AN+YQwjMZuHT5DAYFnzpyJiooKDAx87rnn7t69+/Of/3zHjh2hoaEvvvji559/DrPfv3//Jz/5SVBQ0J49e375y1/CisPSAwMDv/jii8DAQJC+uLgYEBBAUZTT6VQqldu2bQPpOp1uZmYG/N6zZ8/rr7+OGk2CEIqiXC5XW1tbWVmZZCFLS0s/+9nPwsLCwsLCXn31VVA7xgIaZytzWtvlctnt9rS0NHjZvn37uru7OSWIlMlGoVB4PB5QnMPhSE1NhacOHTpksVjwpwBr23kAQBTfFMFWie/6rVu3fvLJJ7Ddx8fHIyMjKd+nDjYYDTnHLMUz/4hh06+VCfsYt9ttNpv7+voGBgYcDkd1dTVFUdu2bbNareBePj8/Hz38wQ9+4Ha7BwYGBgcHBwcHh4eHGxsb+YRjHsaUlZUFBASMj4+bTKb3338fXlNeXu5wOIaHh7u6ujo6Oi5cuADSDQZDYWHh1NRUb29vamqqQqHgS+SjsbHRZDKZTKaxsbHIyMjR0VFMcQxcLld2dnZDQ8PTTz8N7Wa1Wi0WS2trKzrmGXUMDg4eHR29ceMG2l9R47OFoBI4WwdjKHB9b2+v2Wx2OBxxcXFOp3NkZKS/v99ms9XU1MDsp06dAks0XV1dPT09Fy9e5GwyyOnTpwsKCjDmFYNIIS0tLQaDISwsTLKQhYUFlUplsVj6+vpMJtNbb71FURRcOjt58mRubi47F5+1wY0UnLgBTz31FJz+MGBaEMXlctXV1WVmZnIWFxwcPD8/jz8FWNvOg9aac4rAWBg/pXz88cdVVVVNTU2U71PHDhaYEvnGrE9TzcMF/jbHZrNRFDU/Pw8O+/r6oqOj4SnOtTKQZWpqCqS3t7cnJSWB31NTU3q9HmZxu90qlWp2dpZ96PV6FQrFxMQEFALuSb1er0qlgukdHR0pKSk0Tc/OzsrlcsayJmci5i5Vq9UODw+jKXzFsaVlZmaWlpYy7AarxlllUEfUUIz1E04hqARM63BqDq5H145kMhl8pNHX14cuNWg0GrgKYTabk5OTaVaTQerq6o4cOeL1etkWZq8n8DWBeCHR0dFms5lzpUKMEI/H09/fD9OvX78OagewWCy7d+92Op00a61M5FhggF8rw8ikKErzFQEBAXl5eXyLbxMTE2q1Gn+KXuvOg1afc4rgUwkzpQDsdnt0dHRbWxvt+9QBsjPgK5FvzHJONRjEr8FuAuSCTkilUsFbucjIyNnZWcEsCoVi165d4HdcXNzU1BTM3tfXBy+7efNmcnIyvJNFD2dmZpaWlqKioqAQ8GNmZmZxcRFNB71h+/btOTk5KSkp6enpkZGRSUlJ3/3udzkT+XR2uVyzs7MJCQloIl9xDF5//fWurq6WlhY0UaVSsd85YdSRoijUUGzJbCEMo/G1Dp/mKpUKXTsKDg7eunUrzO50OsHve/fuOZ1OvV4PDpeWluRyObt0wB//+Mf3339/YGDg0UcfZVdBJOKF/OEPf9Dr9U8++eTk5KQ0IVu2bPnWt74FD9EuSlFUcXFxc3NzaGgoOyOfteVyudfrxavNB2Z8KZVKs9lMUZTJZKqurm5paQGNxS4ONhDmFLXWnQeFb4rgU4nvekBOTk5FRcVzzz1H+T51UBS1c+dOhnqTk5OcJfKNWZ+mmocNYR+zgjz66KMRERHwcGXfWr569erQ0JDFYnE4HJWVlQcPHjx37hw7saqqCq+hr+UuLCy0t7eDxwPZ2dlwEHKy/Dez/f1uN8Dj8chkssHBQTg7yGQyztI/+uijkpKSrq4uzklZJD4JaW5urqysXKYQBktLS+DHO++8Ex0d/f3vf9+n7GCV+Msvv0QXqYaGhuLi4gIDA5VKpcfjefDgAexdbrdbqVQKipXJZGD6O378eFNTU0tLyyuvvMIozuVy9ff3h4SEqFQq/ClqrTuPn/j0009HRkb++te/SpYAFsdQBgcHfRXCOf9IVmlTgb/NwSxZiFwru379OuPGFuD1ejUaDbx1ZR8qFAqbzQYOxdzwopjNZp1Ox5mIXyszm80MJQXXyuRy+ejoKE3TBoOhrKyM0ziYOqKGYq+VMYQwJGBah2+5A7MAxThUqVTslUO0dJqmZ2dnY2Jirly5gl4m+EoYQw1fhVAUpVarNRqNWq2WyWRgKcknISaTKTExEV7W3t4OFnPsdntcXBy6EohZ02CYS6fTmUwmeGixWOB7ZTRNa7Xa3t5eePbChQsZGRl4mYxTbW1tOp0OrsZERkZ2d3eDy/R6fWZmZmZmJv7U2nYeFL4pgq8I/JTi9XrRPilh6hBcK4Ml8o1ZBpzzD8MCD89amXQf43a75XL52NgY4xA0T05Ojt1ut1gsiYmJdXV1UAIcJD09PXv37oXpjEOapnNycoxGo81ms1gsCQkJsNwTJ05kZWVNTU1ZLJb9+/c3NzfTND06OpqRkXHr1i2n0zk1NXXixAmDwcCZiHkzvb6+Pjk5eWRkxG63l5WVga8KOIuDGVFpVqtVoVCMjIyw7cZXR6PRiBpK0McwJOCHPVtzn6aJkpKSlJQU8L+ssbHx1KlTjNK9Xu+RI0fKy8vRD03AqYyMjPz8fIfDMTY2lpqayvi0BVVDghA4EfT39wcHB9vt9qmpKZ+EzM3NaTSa2tpap9M5PDy8d+9e0KzZ2dnXrl1DJczPz8vlcqvV6vV68dZDv4/p6emJj48/ffo0PHv+/PnY2Nienh6n03nt2jW1Wg1cjngfQ9N0fHz8xYsXwe/m5ubo6GjQt2traymKOn/+PP7U2nYeGhlrfFME3sfwTSk06/sSn6YOTjAlco5ZzqmGTziN7VebD+k+hqbpuro6pVLZ2tqKHp45c0alUjU0NGi12pCQkIKCAvhgEJVWVVVVU1MDRTEOaZqenp42GAwqlUqv1zc0NKC+rbi4WKPR6HS6uro68HR3cXGxrq4uNjY2ICBAq9Xm5+dPT09zJmL+QXi93pMnT2o0GoVCYTQawVNfzuL43EB5efmhQ4fY6Xx1tNvtR48eValUsbGxTU1Ngj6GIQHfOmzNfZomPB5PRUWFTqdTKpWZmZkTExPs0hn3xDD7zMxMXl6eWq2OjIysrq5mfAzEfpAuQQjNmoN8EjI4OJiamqpSqaKjoxsbG0Ei5y1+dXU16OSC7zK0trbGxcUpFIrY2Fj2/HX27Fm9Xh8QELB379729nbBFmS3/uXLl/V6PawC8CUKhSIpKens2bORkZHj4+OYU2vbedjjjj1FYHwM35TC2RA+TR2cYErkHLOcUw2fcABfv9p8CPgYCYg0WWxsLPpuD+OQAfioe2X0WzvwdVwdCRu3dAIezNoUOLV+ms/XWXU5s7C0qWPTz/uryao+80f5+OOPMYcMzGZzdHS0nzXyO/g6ro6EjVs6Ac++ffvwpx7O5tscU8eGZu3jLvPx61//+t13371z587f/va3mpqakpKStdaIsH4hweoF+fDDD19++WV2+uYzncipIyoqamho6Pnnn//Pf/4jUrKvtmJ/3Qn47LPPxAvZ6KzZfYwgaWlpFRUVpaWlu3fvLi8vP378+FprRFinkGD1YigsLGQHL9iUphMzdYCKHzhwICAgoKqq6ne/+52gWAm2Ap83sdncwWOYSFtim5ubq6+vR1O6u7sTExOVSmVKSgp4t8pX2M/uVhBfhW+sBdmJiYmsrKyQkBCtVnvixIm5uTn2Y3A0woLH48nNzWVUkDORltSy7O4hEsGMnO1y+vRp+Na4SObn58vLy3fv3g0e0Tc0NGCeANOs1wp0Oh18g4D9pBpeJpPJ9Hr9qVOngHDJZpHcG2GJTqdTJpOxP0SXYLplwniSv2qFMsqCFR8eHg4PDxcjRIyt4HsfcXFxmPfWOFXarEj0MWwDhYeHX79+fXZ2tq6ujvODGDEy14+PoTdUwO34+PiTJ09OT09PTEwYjca8vDzb/4avP336NAy+yxlgnzMRIKFlJY8fwYycF0jYDwK83mq1WmdmZkwmU1pa2sDAgGC5fJH20a7CuBJEUgEv7/rPLIIZ+SSswlYabJVW38fQrOEMKy5eDUFbYfZ3YEN8jABsA2k0GrvdTtN0Z2dnQkKCNJnrysdsFGZmZuRyOTwE339NT0+Dr/wA8fHx6PuyjAD7fIkACS3rv8nUbrfv378fTZGwH8TCwoJcLoffZkpTDI20L3hlfHw85ynJpfuakVPCmmylsVY+BgWtuEg1xNgKs78DG+Jj/p+BgQHwJUFkZGR2dvbo6Ojc3BxcDYAfx9TW1iYkJJSWliYkJFgsFlQCsGZjYyP+ZfP6+nroBtiF4jVMSUlRKBQajQZ8HoURDpRpamrS6/VKpfLYsWNOp7Oqqgp8N15YWMgIO4heHxISkpeXJzg38WXBv/4vqBKG+Ph48J3dwsJCSUlJbm4uwz4ajQbzkQo+EdOytLjuwdlAoKz6+nqNRhMeHt7S0sLZrwS5ePHisWPHwO+uri78xeAC8L0wn1W9Xm91dbVWq1UqlTk5OezgmIDBwUGw/MhuVvaVsbGx7NpxaouxFbzG4/EUFRWpVKrdu3fX1tbCj1dQY9I0jZYIvlrjM53RaIQfCZnN5oCAANjJi4uLDx8+fPToUZirpqamoKCAb1BzaoIZiajR+KQJDg28/lVVVQwDon0GM9ejDYRm4ZydgLUZo2xgYMDtdnPahDHDcE6PmwPh98rYMasZgf3BZSBOQ2tra1dX1ze+8Q2GEL8Gyh4eHi4uLp6enrZYLDqdDm4rwidcfIhyeP3IyAiINz41NcW+gI2vWUSqxBmEnKKozs7OmpqarVu3BgcHd3d3M6Jztra25uXlMSLPiwffsmK6B18DMXYuYGfkqy8KGoOrsLDw8OHDQ0ND7Ms++OCDw4cPFxYWUhQVGBiYmZmZm5v7l7/8Bd31BMC5xQMDNNI+njt37rzxxhtGo5FdO05t+WyFwhk5n70NBGPHDYzpDAaDyWQCiZ2dnUtLS11dXeDQZDK99NJLPT098FWojo6O7OxsChufn6GJ4B4WeGmCQwOvP7uZBOO2ob2FnYVzdsLv78C30we+7psEvAvii1nNcP4tLS0JCQnT09NpaWlgiWZ8fBx++mTzc6BslPHxcfAEDxM5nxIRohz9l0Eh8cZ7e3thCHQ++LJg7mPEqERzBVYC6eXl5fv37x8YGLh586ZOpwN/lAAejyckJIT9gZ7I+xh8y4rsHiiwgWxcOxcwMvLVF8LeHqK+vl6tVh87dgxGORobGzt27Jhara6vr4f3LvPz89XV1bGxsXK5PCYmBv3qm73FA9RWTKR99Eq1Wq1QKEpKStiRh/i05bMVmpEdOZ/TmDTrzzKf6RwOBwjcSdN0cnJyZWVlXl4eyBUcHLy4uJiSknLt2jUox+Px8A1qtiaCe1jQ/FOEyKEhqD9aFqPPMCzD2VvQLBL6PL6r89V90yC8Vpabm5uYmFhZWdnU1ARi7dEsg8Jh6XA4NBpNfX19f38/DDtos9kUCgW8eHR0FExSDoeDkQ7XyjgL5WN4ePjIkSORkZFgVAMhfML5JnrGId/gFPNcB78mJj5dZImLi4tKpRK+8XXlyhW0j7a1tXE+RBHpY/AtS4vrHpwNJH6xDkN7e3t6ejojcXZ21mg0wmdUcrncaDTyrXB6PJ6+vj74AH9ubg6Ex2crplQqgZ9rbW0NDw/njJDEuNLhcKCiOGvH0FbQViDcPfR2arVaq9Xy2Q3jYximS0xMvHXr1vT0tE6nm5ub02q1Xq+3paUlOzubpumGhobCwkKaps+fPw+WjPgGNbsgMSNRpDTM0MDrj8phVJxRBGdvYWTh7PN2ux2tAgq+q/PVfdMgvFZ29epV8Gd2cXGxsrISRBdHuXPnzuzsLPiWOCIiorW1tba2trGxkX1LKB7BQlGMRuOhQ4d6enrMZvONGzckF7r+4Vw7mp2dXVxc/OY3vwmuSUxMtNvtMEtra2tRUZG04sS0rJiWktxAgmtl7EWP27dvg3imp06dAikgmmdpaent27fZRWzZsuXb3/52c3Pz73//e5jIucUDiLS/c+fO48ePazQaxoIk55URERH43SLY2graCkbON5vNZrN5ZGSE7yMMPAzTZWZmmkymzs5Og8Gwbdu2xMTEnp4euNCUnZ0NlOns7AQLZesNvP4o+IUyzt7CyMLZ51Vf7aqAShsaGmIvxj50+OSRYMxq1DODe2H0Zr+4uJiiKPh82ObPQNnst6pgKG985Hyo26rdx8zPz8tkMnQNzdf7GL61I4VCAeMhtre3o0HLFQrFzMyMoJKciYIty4Cze/A1kBgF8Gtl7L0GSkpKVCpVZWUleFAPcTqdFRUVKpWqpKQEpDAe+Pf09MAlUPYWD2zF0Ej7gs/8+U6xtRVpKxUrcr6v9zFs0/X19SUnJ2dlZd24cYOm6QsXLpSXl4eHhzscDnDB3r17TSZTSEgI6MB8g5qtiZiRKFIaZmjg9Ydy2BVnK8zoLewsKOjsxLe/g+B9DGfdNw0CPoYvZjUjsH9paenBgwctFovT6WxtbQWvT8CvB2x+DpSt1WovXLgwNzc3NjZmNBpht8NHzoe6rZqPoWk6OTn5xIkT09PTINT8iqyV0TRdVlaWnp4+MTExPDwcGxsLX8pqaGgwGo1ilORLxLesyO7B2UCcCjAy4mHvlZCfn2/7auMQzirn5+fTX8VJvHTpksPhmJubA3Lg15GcWzywtYWR9sX7GEbtOLXltBUaCp7mipzPVygscWpqCl2QYZsOFK3VaoHjtNvtwcHB6KIoeL0QjkS+Qc2pCedIZMS3FyMNPzQw+kM57IqPj49zji/YWxhZMLMT3/4OYnwMZueCjY6Aj8HErEYD+3s8nurqar1er1Ao9u/ff/ny5YmJCaVSiY5P/wXK7unpSUpKUigU4eHhlZWV6L9+TOR8wCr7mPHx8fT0dJVKFR8f39zcvFI+xuPxlJWVabXa3bt3NzU1wfS4uLjr16+LUZIvEd+yIrsHZwPxTYuMDSMwsPdKEM+NGzfS0tKCg4OVSmVCQsKlS5fgKc4tHtjawkj74n0MLaJ2fJ0ZhoKnhSLnc5bY0tKC3pJymi4vLy8nJwceJiUlodeAFTmoOd+g5tSEcyTSrPj24qP9cx5i9Idy2BW/du0a/qsvRhb87MS5v4Ogj+GbHjcHKx/bn42vD3IJBDGsn2D1G4Ly8nL44FqC6cC7uXyvYy2TVZsiGBX3eDx6vR59D1Mwy4qz6afH9RsTk0DA83AGq5dMU1MTfDtAgulu3ryZmpq6ffv2ldZrVWFUfMuWLZcvX/7Od74jPgvBVzaMj+H8/o6iqImJibUKYroOVSIQ+HjssceeeuopaXldLtf58+fZYZs3AXgHQ1g+G8bHrMMo2etQJQLBH2i1WoPBUFBQsNaKEDYggqtpvuZafpD/lYUdsp4dCR+kO53O/Px8jUbD3kB+RYSsjmXEvCPAh6CGFRUVCoVCzCbk+Fd4BTVcb72IQCBIQ/gbTBCl3Gq1hoSEwFjxmOtzc3Pr6ursdntGRobkr/9Wivv372dkZHi9XjTRYDDExcVZrdb+/n6n01laWgrSCwoKlpaWzGbzrVu3uru74WdxKyKEWmeW4QSv4d27d5ubm/v7+/Pz8/fs2eN0OtdKEwKBsGEQ6YvE/ztefpD/FcTGClnPGQmfpmm32y2TydDISLGxsSsohF4tyyznPgavoU8vwCzzPmZd9SICgSAZiT4GE0SdLxS8DQnTzQiSz/cWPJpFWtB7TvmckfAFv4NZvhDB7Q/E1NTtdhcXF2s0Gp1OByM58m2RwA4CjzcURkP0roWxVsZZCvuLfU4NJWhC+7j1AyxdqVRGR0efPXtW8LMkX+1GIBD4kPjMv7CwMD4+vrGx8cCBA4xTKpVqYmJifHx8fHw8IiICPQUj3rvd7qKiopqamnfeeQdfEIzsvbCwUFRUFBcXZzAYRkZGwFRbU1Pz9ttvU1yveN25c4dPZmdnZ2JiYlVVldfrjYmJGRwc9KHmyxCCsQwluqbl5eUzMzPDw8Pz8/MFBQVqtfqVV16BsdMXFxeNRiOUCYPAezye0tLSixcv/vSnP6X4zYXRMDQ01Gq1JiUlOZ1OuVyOhkTjKwWFT0MJmlAUZTAY6uvrs7Oz5+bmrl+/jt/6AZZutVoXFxfFhNvy1W4EAoEXkb6I8ZecLyw5JhS8jT9IPuY+hlpe0HtO+ZyR8H29j/FViJjtDwRr6vV6weQL0js6OlJSUvhip9NcQeAx5sJryKgd+puzFPQCjIYSNPF16wcxseUZjeWT3QgEAoZlPY9hhCWnsaHgMUMav1bGp4P4Bw+oHL5I+D75GAlCBLc/EFNTh8MREBAA08fGxkDUP87Y6ZxB4DFWEgzjz+lj+EpBL8Zs4iBNE5+2fvB1lwdf7UYgEDBI/z7m9u3btbW1aFhydih4o9E4ODi4nCD/IhG/iIGPhC8SX4WsiWVgEHi5/L+tLJP99zVCtrlGR0elaYgpRQzSNLl69erQ0BAICllZWXnw4MFz586JLxSPT3Yja2UEAh6JPubll1++fPlycXHx2NhYaGgoSFSr1XK5/J///OfXvvY1iqKeffbZoqKiS5cuWSwWvDS1Wr2wsPDZZ5+BrxclTPrit9AICwuTy+W3b99+/PHHKYqyWq16vZ6iKI1Gs7Cw4HK5tm3bBnTQarUrJUSyZRhotdqAgIB//etfUVFRsFxQxCeffLJr1y6KosbGxsDFERERSqUSztcobHNJ1hBTCqo2p4bL0eTAgQPgWWBmZqbBYMD4GL7S+XqdT3YjEAgCiLzfYaze8AVRx4SCxy8H+SnoPbwSlcMXCT8jIyM/P9/hcAAdYAT7FREiuP2ByJqeOHEiKytramrKYrHs378fxHbljJ1OcwWBx1gJryHNs1bGVwojHD2fhhI08XXrB0zpnL3OV7sRCAQMK/x9DCYUPH4a9VPQe3glKocvEv7MzExeXp5arWZ/or98IWK2PxBTU8F3l9HY6ewg8Bgr4TWk+X0MXyloOHo+DSVo4uvWD/T/vruMls7Z63y1G4FAwPAIzRMthkDYlExOTiYmJt67d2+tFSEQHgp8eDxLIBAIBIJPbJi4ywQCHrLVAoGwDiE+hrBJIFstEAjrEPI8hkAgEAj+gjyPIRAIBIK/ID6GQCAQCP6C+BgCgUAg+AviYwgEAoHgL4iPIRAIBIK/ID6GQCAQCP6C+BgCgUAg+AviYwgEAoHgL4iPIRAIBIK/ID6GQCAQCP6C+BgCgUAg+AviYwgEAoHgL4iPIRAIBIK/ID6GQCAQCP6C+BgCgUAg+AviYwgEAoHgL4iPIRAIBIK/ID6GQCAQCP6C+BgCgUAg+AviYwgEAoHgL/4PlE1fk74HXSYAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAVq0lEQVR4nO2dfUxT5/fAr8iglFKglKKlCnQEkRBERYYLc4QsDhlhxIE6xJdthBkDiMQRcM51yqbiS1xlzDmXgFmcMYYxsjhiGmeQGYLIEAsiEsdLKQwLo1ixYKG/P57fbu73vkNtEXY+f93ee+55znOeh3u4z733nAVWqxUDAAAAADvgNNsGAAAAAPMWiDEAAACAvYAYAwAAANgLiDEAAACAvYAYAwAAANgLiDEAAACAvYAYAwAAANgLiDEAAACAveCOMQvo8PDwcIBxjsRoNB45cuTlUTuDE/fu3evm5lZRUcGkp7u7e1YGjme7dhoCAABmkQWc3/mPj49jGNbV1RUTEzMwMIBhWE9Pz6pVq548eeIIAx1Fd3d3eHj4C+/UjNVO98ShoSGZTNbU1BQeHr5w4UJaPXbqIx/Gx8ddXV3ZZWbRPAAA7IQzpwS6NAgEAnzbxcXF3mYB08VkMgmFwhUrVsy2IfRwBhgAAOYlM38e8/XXXwcFBfn4+Gzbts1oNOL7x8fHP/roIw8Pj4CAgM8//3xycpJ4Flo2OX78uJ+fn7e3944dO549e4YO3b59e+3atW5ubr6+vmlpaX19fUj4yJEjvr6+ixcv/uGHH2jFcLUnT54MCgpyd3ffvHnz0NDQJ5984uvr6+Pj88EHHzx9+pTFPKPRGBgYaDKZFixYgNaaqGK0xhC5ffv2G2+84eHh4e/v/957792/f5+qlsV4ombqiThPnz79+OOPfX19lyxZ8sUXXyD7h4aGaOVp9dAOHPuo0fYO7Z+cnCwqKvLz83N3d09LSxsaGqJ2h7hWxjQBWLoMAMDcZYYxxmQyNTc337p1q6GhQa/XFxYW4ocOHTo0NjbW0tJSU1NTW1t79uxZ6rkNDQ2NjY2NjY1NTU0lJSVof1NTU1ZW1sDAgFarVSgU2dnZSLi9vV2r1ZaXl8fGxjKJ4SbV1dU1Nzfr9frQ0FCDwdDS0lJfX9/V1bV//34W8zw9Pdvb20UikdlszsjIYBKjGkMkKSlp586dPT09dXV1sbGxAoGAqpbFeKJm6ok4ubm5er2+qamppqamurq6rKwMwzAfHx9aeaoepoHjHDVq79D+kpISjUaj0Wg6OjrkcnlbWxuno2gnAEuXAQCYw1j50dXV5eXlhW9jGDY6Oop+3rp1S6lU4pJSqdRkMqHt5ubm6Ohokh4Mw3p6etDPysrKqKgoanOdnZ2LFi1CwsPDw0xWITFc7cjICNpfV1fn5OQ0NjaGWxgcHMxuXldXl0gkYukFuzHDw8POzs5ms5m0n6SWxXiSZtoTLRaLSCR69OgR+lldXR0TE8PeEHE/y8CxjxpT76xWK3oIRGqR1B2qDbQTgMVXAADMUbifx9AiEonw1Q+5XD48PIy2//nnH4PBEBgYiH5OTU05O5ObEAgES5YsQduhoaE9PT1o+88//ywoKGhra5uYmJiampqamkINeXt7E0+nFUOSnp6eaFuhUIjFYjc3N9xCg8HA0zwWMaoxON7e3qmpqTExMfHx8XK5PCoq6s0336SKsRjPpJnI4ODgxMREUFAQ+hkaGoou2fyhHThOtzD1zmg0Dg8PR0REUFth6Q7TBAAAYP4xwxjDhNlsdnJyamxsxC9STk58l+NSUlIyMzPPnj0rEAh0Ol1CQoItYraYRys2MTHBrvynn366c+eOVqvV6/X5+fmvv/76mTNnXqDx9oOPW1h6R3yNDQAAgMgLjjGLFy8WCoXDw8MrV65kkjGbzb29veg/2Y6OjqVLl2IY9vjxY71e/9lnnyEZdNtBhaeYLeYxiXV3d3PqX7169erVqzEMS0xMTEpKIsUYG43HMEwmk7m4uPz111/oVqa9vR2/+bAFnm6h9s7T01Mikdy9e3da77PRTgAAAOYlL/47/4yMjN27d7e2tvb39x8/fvzw4cNUmfz8/L6+vtbWVpVKlZSUhGGYr6+vRCL59ttvjUbjw4cPVSoVrXKeYjMwTyqVms3mhw8f8u8Fkfv372/YsOH3338fGhrq7e0tLS2NjIwkqZ2W8SR7EAsXLtyyZUteXl5vby/yXnp6OrthtHqosPeXqXcYhuXl5WVlZd27d6+vry8nJ+fmzZvsDSGoE4C/qQAAzCV4PrchPfMnPpslHrJarWazOS8vT6FQCIXCxMRE/AE18dyjR4/KZDIvL6/t27fjT+Zra2ujoqIEAsGiRYvy8/O9vLxoHwJTxThNIv5kMU+lUgmFwvLyclox9ifSExMTKpUqJCTExcVFJpNlZGQMDAxQ1fIxntYeHJPJlJWVJZVKFQqFSqWyWCy0g0Krh8VL7KPG0juLxVJQUCCVSgUCQUpKisFgoFpCeubPNAGYugwAwNyF+zv/Fwt8y/0fByYAAPyngJyYAAAAgL2YRowJCgq6e/euLY0FBQXh34c7HtvtB2YRGD4AmIvwjTH37t2bmpqyJR0W0rB8+fIZa7AF2+0HZhEYPgCYo/CNMdXV1cnJyaSd3d3d6FM7PsnbaTU4DLz1x48fb9261cfHx9/ff+/evSirNIZhQ0ND27Zt8/X19ff3Lyoqev78OX7u+Pj4+++/T+zgDJQgNmzY8N13381ASXd3N6m8woYNG2h7Sk0OxuKWioqK5cuXu7m5LV++nPimNfVEPmNNMnLJkiUkJ5w5cyY+Pn5iYmLlypW//fYb8dwzZ868+uqrrq6u1EPYv8M3W7UJWLDFJDt1xzFeYmplBq3PoKYD07x1GE+ePNmzZ09AQICbm9uyZcuOHTuGpzTEZaBWxf/D892A6Ojoa9eukXaSXkzio2G28oXg9ickJHz44Yd6vb6zszM+Pn7fvn1IIDExMT09XafTtbe3x8TEHDhwAO03m81xcXGpqalEs6erBNHe3i6TyfDXqKalBPnNTGBiYoK2p9SXuJh8cu7cOYVC8euvvxoMhhs3bgQHBx86dIjpRHysWXQSjUTZz4hOUKvVgYGB169fHxwcvHTpkkQiqa2t5TyEmN3Jw4KNJnH+1cwAx3iJT+4iG1UxwTJvHUZqampKSkp7e/vg4KBGo4mLi2toaLD+74C+hNN1VuAVY/R6vZeXF/WiRnpFmI+GWfE73rrJZBIIBHhiroaGBpTHzGQyOTk5EdOdhYSEoO2urq7i4mKi2TNQgti9ezd+wZ2uEv5+4x9jFAoF8f+GpqYmoVCITLIlxhD31NXVhYaGom25XH79+nX80OnTp5OTkzkPWWd78rDznzVpFmMMy7x1DGNjY87OzvgfKRMv4dyYFXitlVVXV69fv/6VV17BMKyvr+/tt9/28PBYtmzZxYsXkQB+k8iUAJ+oAWOuC0BNXG9j0n5S6+7u7s+ePXN3d0f7JyYmUC0cg8EgFAqJ6c4GBwfRdkBAwKeffkr0xgyUYBhmNBovXbqEJ1qegZKpqak9e/b4+fn5+fnt3bsXdZC0gEY7fLTeNhqNOp0uLi4OF1u5cuWNGzdoNfDUSUUgEJjNZtScXq8n5mBet26dVqtlP4RwwOTBbKhJQWsSuzxRJ9pmKp2A2Lx585dffon/XLt2bUVFBWllBl/MpDaBPODt7b1161b2MhxMf7+0NSkwDDt27BhLBzm9ilFqOtCWriDJM81bWuOZFNI6nH0UcFCaQWqqQ+KI8CkXQqt8/sE3xuCPUrKzs8VicVtb29WrV/EYQ4Q2rztRA0tdANrE9bYk7ae2TqS4uHj79u18PMACTyXnz59PSkry8/ObsZKxsTGRSKTVam/duqXRaE6fPo1hGL50VlBQsGXLFupZTN5GN1L4hRuxZs0aPOyxwDKCRIxGo0qlSkxMpG1OLBaPjo6yH0I4YPJgNtSkYPEwrTwtTKUTEJs2baqqqkLb/f39zc3NKSkpLNpIZre0tCDzenp6OLtM+/fLVHej8V+YOsjpVVJNB9pBJHWHZd5SjWdSSOtw9lHAcXd3T0xM3LJlyx9//EH8N4WlX3xcMW/hvNMxmUwikQilardYLAKBgJiYnbR+QpumnqiBJb08beJ625P2E1snolKp3nrrLfSdPHuaAKrADJQolcrm5mba1UU+Ssxmc319Pb6/qqqKmH5fq9UuXbrUYDBYKWtlTN5mv5FnXytj0YlhmPRfXFxc0tPTmRbfHj16JJFI2A9ZHTV5rDOtScFkEp8aFnjHWUonIMbGxsRiMdJWVlaGFhKZpgrLBKirq2Mvw8FZTcP6v3U3aB3CXiODqhA/haV0BVWYVg/JeCaFtA7nHAUio6OjhYWFISEhzs7OwcHBKOMGdUSm64p5CXdOzGvXrkVHR6PbcLRuQ0zMTpWn5nUnasCY6wIwJa63MWk/qXXEL7/8cuHChYaGBltyBvNX8vPPPwcGBq5YsYKaWJOnEldX19deew3/SUqJn5WVpVarfXx8qCcyedvZ2dlisbCbzQSTTgzDhEJhc3MzhmEajaawsPD8+fNosKjN4WPEcghzyOTBbKtJwWQS/xIGnIUh3NzcEhMTq6qqcnJyKisrd+7cyaSKCtE8hULBWYaDti4DbU0Kzg7yLKWBw6d0Bfu8JRnPpJDW4Uyj4Ovriyt8/Pgx2kCLckeOHBkfH29qasrPz7dYLJmZmUyGTdcV8wnuftr+zrED3lpmyU5Pbb21tXXXrl01NTW0F2WeTEuJWq3Oz8+3UQkJvPbMN998o1Qq33333Wmdju7inz9/Tlx2uHPnTmhoqLu7u1AoNJvNk5OTeOQzmUxCoZBTrZOTk7+/P4ZhO3bsOHHixPnz53NyckjNGY3G+vp6Ly8vkUjEfghz1CvvttSkeCFwFobYtGlTaWlpRkZGQ0NDZWWl7S1Oq4DFzGpS2MOrLPN2WnpoHU67E/3PxISrq+vatWvVanVGRgZLjJn1CTabsN/mWCwWqVSK32yS1sqqqqqoa2WkO1mSBpYFJablDp7JLkUiEakgI7V1q9U6PDwcHBx88eJFohjnK2EkM6arBMMwiUQilUolEomTkxNaSpqWEo1GExkZiYtVVlaie22dThcaGspSdJLFewqFQqPR4D+1Wi3x/RyZTFZXV4cfLSsrS0hIYNdJOnTp0iWFQoEvPsjl8hs3biCxwMDAxMTExMRE9kMOmzxWhvlDFMYIS0NVVVW0S0OkFUWqPEkn7bJPc3OzQqEg7TSbzRKJ5PTp0xs3bkR7RkdHnZyciOtgtGtlLB6gdpnWpMHBQWdnZ6J5KF8tH4ewe5XUKJ+1MivzvKW9+PBRSOtw2p04pNfYamtrlUol+1oZH1fMSzhiTG1tbXh4OHFPSkpKamqqTqfTarWRkZGcMYakgX3SZ2ZmJicn9/T0aLXaVatWqdVq/peJXbt2xcTEoP9BSkpK0CvzpNYtFstbb72Vm5tL/NAEHUpISMjIyNDr9R0dHbGxsaRPW4hmzECJ7l/q6+vFYrFOp+vp6ZmWkpGREalUevDgQYPB0NTUFB4erlarrVbrxo0br1y5QtQwOjrq7Ozc3t5Ou0BM9B7xO4Pa2tqwsLDi4mL8aGlpaUhISG1trcFguHLlikQiQSGHf4yxWq1hYWFnz55F22q1WqlUXr9+3WAwHDx4EMOw0tJS9kMOmzxWhvmDDwq6pBJnvkqlYjGJSZ4Ifm5bW1tCQgLqfk9PT2ZmZlJSkpVCenq6WCy+fPkyvic6OjozM3NgYABNFdQ0/wlA7TJT2JPJZGVlZSMjIx0dHSkpKXiMoXaQ2DqTV0mYTCZnZ+eOjg7aQaTKM81bWuNpFdI6nOcoWP/90O3cuXN6vX5kZATN0q+++opkALFfPF0xL+GIMfv27du/fz9xj06nW79+vUgkCgkJOXHiBGeMIWlgn/TUxPX8LxO02emprZNu4/DTBwcH09PTJRKJXC4vLCwkfQxEfY46AyVWyjVoWkoaGxtjY2NFIpFSqSwpKUE7ae9KCwsLOZP5I8rLy0NDQwUCQUhICPXv+dSpU4GBgS4uLuHh4ZWVlZwjSB39H3/8MTAwEO8CiiUCgSAqKurUqVNyubyzs5PlkMMmj5WrmkMXQ0kC9gfvTCUMSN1hKZ1ApKqqSiQSEfWgr3dFIlFYWJharca7w3MC8C9gwVR3o6SkhNpBvHXaJqjKrYSaDkylK0jQzlta42kV0jqc5yggrl69GhcXJxaLhUJhRETEuXPnaA1gLxfCpHyewRFjQkJCiK8zzQDbNczd1gF2WJYO0KGXZ/hYXmd6IfIAMF9xdP0YAJiLTLfsDZTJAQDEf+bdBgAAAMDhQIwBAAAA7AV3jKHNYs2/AT65volJsF/C/O0AEBAQMK2Fr+nKA8B8hft5TFpamsViOXr0qEQiaWlpKS4uLikpWbNmDf82xsfHXV1dWQRIi9ec8gAAAMCcgCPGPHv2TCwWGwwGPCGHPYAHpAAAAPMSjrUypizWGIZNTk4WFRX5+fm5u7unpaUNDQ1hdOm1SWn/qdnOSUmwSfJMacn7+/vfeecdDw+PoKCgkydPUjMsAQAAALMOR4xhyWJdUlKi0Wg0Gk1HR4dcLm9ra0P7aXOD44eo2c6pSbCJ8kxpybOzs11cXDo7OzUazYULF2xxAQAAAGAvOL+goc1ibbVaZTIZ9Rs6anptYgoAjCHbOW2GJZa05ChtGv6hLF5iAAAAAHip4H6vDK19PXjwwGQyXbhwoaamRqVSGY3G4eHhiIgIqjxtbnAE/2znuCratOSDg4NTU1PElN2cvQAAAAAczzS+j8GzWF++fBntsaX4CgAAADDv4Y4xpMcwZrPZYrF4enpKJJK7d+9OqzGz2dzb24u2Ozo6li5dOq3TcWQymZOTE17vq729fWZ6AAAAALvCEWMePHigVCq///77/v5+o9F48+bN3bt3o1I8eXl5WVlZ9+7d6+vry8nJuXnzJp/28vPz+/r6WltbVSpVUlIS2imVSs1m88OHD3kavXDhwqSkpLy8vO7ubqSK54kAAACAI+GIMcuWLSsvL7948WJoaKhcLs/Ozs7NzS0qKsIwrKCgIC4uLj4+Pjg4WKfThYWFcTYmEomioqJWrVoVGxsbERFRUFCA9ru7ux84cCAyMrKiooKn3aWlpRaLJTw8PCkpKT09nedZAAAAgCNxXN5l+31o+eDBg3Xr1v39998vXDMAAABgC/MhJ2Zzc7NSqZxtKwAAAAAyNB/wzwkOHz4sl8uTk5MfPXq0f/9+VKAXAAAAeKmYq/cxcXFxZWVlCoUiIyMjNzd3x44ds20RAAAAQAbqYAIAAAD2Yq7exwAAAAAvPxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHsBMQYAAACwFxBjAAAAAHvxf9NII58eVnzWAAAAAElFTkSuQmCC)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 24 September, 2020 07:46 GMT
Vulnerability Verified: 24 September, 2020 09:08 GMT
Website Operator Notified: 24 September, 2020 09:08 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 24 September, 2020 09:08 GMT
Vulnerability Fixed: 25 September, 2020 05:37 GMT