Lucene search

K
openbugbountyDevl00pOBB:1363241
HistorySep 24, 2020 - 5:39 p.m.

etg.lu Cross Site Scripting vulnerability OBB-1363241

2020-09-2417:39:00
devl00p
www.openbugbounty.org
59

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: etg.lu
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAALoElEQVR4nO3db0hbVxsA8FObpTEm/kljptZpIm0EJ1kqIrr1g5TRSepKOhwU166bK1txskmxTLJ/wYJzrYZNpBQpw5Ux9mHIEClSQtmCc+IkpGkQ60IW0/Q20KBRY3ZnY+774bDzhuTem5guS5s+v0+ec889eZ7npveYk8TuYhgGAQAAAGmQk+kAAAAAZC1YYwAAAKQLrDEAAADSBdYYAAAA6QJrDAAAgHSBNQYAAEC6PBZrjEqlunXrFlczWz0laQIAnmaZX2Nu374diUReeOEF1ma2ekrSBAA85RKsMcvLy1KplPXQ2traF198wdVM3sTExLFjx7iaGbTTjHhqFY+kubq6+vbbbxcXF+/bt++jjz56+PBhKrH+G7jiX15eLioqSmaGjY2N0tLSO3fu4Obq6uqpU6f27t0bn9ovv/xy8ODBvLy8pqam27dvJxPG4yw+5uiibWxsfPjhh5WVlbm5udXV1V9++eX29nYmwgQgA1J/HRMIBPr7+7mayXts15iUM0oGSfOtt97a2tqy2Ww3b96cmZn57LPP0vSICVVWVvr9/keZYXh4+OTJk9XV1bjZ0dERiUTsdrvZbLZYLNHFPHHihNFo9Hq9LS0tHR0djxT3Y6+jo8Pj8dy4ccPj8Vy+fHlqaspqtWY6KAD+Kwwvt9stkUiSOcQzkgdFUYWFhVtbW6zNzNppRsmPJ2mGQqHy8vJgMIj75+bm9u/fn0qs6eR2uwsLCxMOW19fr62tXV9fx02apgUCQSAQwM3p6emamhoyWC6Xe71ehmEmJyc1Gk3Mw6XwRMqs+JhJ0UKhUHQdAHjaJPU65uuvv1apVHv37j116tTa2hpCaG1tTalUBoPBXbt2ffvtt9FNk8kklUovXbr07LPPFhUVnT59+q+//uKaeWJi4siRI88880xM8/jx45cuXcKdt27d2rNnD35chNB777134MABnqPnz5/nP/38+fPRMfz999/vvPOOVCqtrKz8/PPP8T5GTIIIofv37x89elQqlapUqqGhIf7to5jNk5jtJpJmbm7u3bt38/LycL/T6SwrK8Pnshbw999/b2pqys3NLS4ufv311+/du4f7uWJjTS2ZmO/du/fKK69IpdLq6urvv/+e5yxiZGSkp6eHzEDTdCQSEQqFuCkSiUKhEBnc2dmp0+nef/99g8HAPz9ryjjUoaEhlUpVVFT0xhtvkOu7o8vEWh+eyVMQiUQQQgKBIOUZAHiiJV5jgsGgzWabmZmZm5ujKKq3txchVFBQsLi4KJFIaJo+efJkdPP48ePBYHBubm5+fn5+ft5qtV68eJFrcq6NstbWVrPZjDsnJycjkcjU1BRums1mvV7Pc1Sn0/GfrtPpomPo6+sLhUJ2u31qaspisVy5ciU+QYRQV1eXUCh0Op1ms/natWsJ68aDdT/wzp07PT09g4ODCCGuAlqt1nfffdfn8zkcjvLy8q6uLtzPFRtrasno6urKz89fWFi4fv169BpQHAf3b25umkymvr6+ffv2ffzxx9vb2wUFBXV1dQaD4eHDhxsbG0ajsb6+nswjkUhcLtfY2NjU1NTzzz/PEwlXysFg0G6346elx+MxGAz8pWCNnKs+XJOnIC8vT6fTnThx4tdff93c3Ex5HgCeVPwvc9xuN0KIbIDMzMxUVVWRQ6x7ZfgUj8eD+8fHx+vr6/HPHo9HqVSSU4LBoEQiWVlZiW9SFCUWi2maZhimoaHh3Llz7e3tePL8/HyPx8NzdGtri//0mL04uVxOdqtsNltDQ0N8guFwWCQSuVwuklT89lH0+PjikPExWWNer7eqquqHH37gL2A0p9NZUlLCHxtXaqxIzHjC6ADIhN44uH9wcFCv1/v9fqfTWVtbOzw8zDDMwsKCVqsVCoVisRghdOPGDTz46tWrGo3G5/M1Nze3tLTgXBQKBWvpWFOOeVpOT0/jpyVPKVgjZ60P1+TJlC66hzz0+vp6b2+vWq0WCAT79+83Go3hcJh/QgCyxs7ej4n+l8OzxohEItK/sLBAbh/hcJiiKHJofHz88OHDXE2tVnvz5k2fz1deXh4IBBQKRTgcvnr16muvvZbwaDIDsJWVFYSQ/B8ymYz1ZkdRlFAojE4q5TUmJk2ssbER35f5C2i1Wl9++eWysjIcKp6TKzae1FiRmCmKigkg4fsxarWarEkTExPRi2IgEDCZTNE9CoXCarXiB5LL5f39/bOzs1qtNiYMnpS5ypvMZSK46sNz7bjwrzEETdMzMzONjY2ffPIJ/4QAZI3/dJt49+7dpaWlpMn/iTKdTmc2m10uV2tra0FBgVartVgsZKeL/2gyAzCapnNycubn58mOeU5Oer8zFL9Rdv/+fbvd/ttvvyU8V6/Xnzlz5sqVKyKRCH8oi2dwOlIjm2PEgwcPVldXXS7Xc889h3vUajVFUWSAWCz+6quvRkZGyPiVlZWDBw8ihEpLS8fGxvR6/fz8/KFDh1gfcUcp7yhyu93+b9UHv2je3t7evXs37gkGg/jVW7Q9e/Y0NTXhT99duHAhtccC4MmSljWGpum7d+/im87S0lJFRUX8mO3t7cnJSfJR3ZgmQqi1tbW7u7ukpOTs2bMIIb1e/9NPP/38888mkynh0WQGYKWlpWKxmNz1uCgUipycnOXl5crKSoTQ4uIifwVkMlkoFNrY2MDvgXu9Xq408eQOhyNhAR88eEBR1KefforHkM8Zc8WWZGqsySKEogMgh2w2W/x4sVgciUT+/PNPlUqFA4i+4mNjY3K5/NVXXyWVEQgEf/zxx4EDBxBCR48e7ejoGB0djakAxpUyT+Rclyk+8pTrE6+4uFgmk83Ozr700ku4x2KxaDQa/PPm5ib5WAdCiKbpcDj8iI8IwBOD/2UO//sKAoFgaWkppom3s9va2rxer8Ph0Gq1RqORzIDfI2EYxmKx1NbWkv6YJqZQKBQKBT7F6/Xm5+eTHZWERxMOIJGcPXu2sbHR4XBQFHXx4sW+vj7WBNva2vR6vdvtdjgcGo2G1IHMs76+LhAIFhcX8W57Q0PDmTNnfD7f0tLSoUOH8HjWNKMnYf55P4C1gAqF4vLly4FAYGlpSa/Xkxi4YuNKjVX0tdbr9dEBJNws0uv1LS0tbrfbbrfX1NR88803uD8cDldVVU1MTEQP7uzsfPHFFx0Oh9/vxytQSUkJ2T6KKSNryjxPS65SsGKtTwp7ZQzDjIyMqNVqi8Xi9/t//PFHmUw2PT3NMMzi4qJCoRgdHaUoKhAI4CdAf39/wgkByA6przEMwxiNRrFYPDY2Ft0cGhqSSCQDAwMKhaKwsPDNN98MhULxs/X09BgMBjJVTBNrb29va2sjzfr6+ugx/Ef5B0RHQtN0d3d3eXm5WCzW6XTkHeOYBH0+X2trq0QiUSqVAwMDrDe73t5eMt7pdB4+fFgikdTU1AwPD+PxrGnGVBXPyVpAi8VSX18vEolKSkrOnTtHzmKNjT+1eNG5eL3eI0eOSCQStVo9ODiY8Cbr9/vb29tlMllFRcXAwADpv3btWl1dXcxgmqZ7e3uVSqVIJKqrq/vuu+9cLpdYLLZYLPFlZE2Z52nJVQpWrPVJbY1hGMZkMimVSqFQWFtbOz4+TvqvX7/e3Nycn58vFos1Gs3o6GgyswGQHRKsMSlI8jt0arV6dnaWq/mYw7+cpnBiMmk+4pcQU44t+0ApAMi4jH01jPxVK9bmY85ms1VVVaVw4n+QZsqxZR8oBQAZB18/TtaFCxfKysqOHTvmcrkMBkMG/7BYvB3FFv8JK8zlcj1xf4wyXvouU3bXDYA0gTUmWc3Nzd3d3Z2dnRUVFR988MHp06czHdH/7Sg21s+GIYSy40aZvsuU3XUDIE12MQyT6RgAAABkp8z/H2UAAACyFawxAAAA0gXWGAAAAOkCawwAAIB0gTUGAABAusAaAwAAIF1gjQEAAJAusMYAAABIF1hjAAAApAusMQAAANLlfzV3Cls5iewSAAAAAElFTkSuQmCC)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAbwElEQVR4nO2db0ybxx3HnxIXjDEEPGMIOGAYIylDjDCKoEkrlE5dShhyuiRiFC2MoJRRBhSxjrKOMphoSgFFNEIRSidaRV1fRFmEIsQqq0o9yjISkEMt5lDGiOc4NHEoEEMdMDx7cdrp0fPfDzbmz+/ziufhnrvffe/s893zPN97iiRJAgAAAAB8QIC/AwAAAAC2LTDGAAAAAL4CxhgAAADAV8AYAwAAAPgKGGMAAAAAXwFjDAAAAOArYIwBNpSEhITbt2/7O4rNzu3bt3/961/TTu4o6RISEkZGRn7xi19888034i/ZOfpsIWCMATaOr776am1t7Uc/+pG/A9nslJSU6HQ66pkdJR2q7I9//OPAwMC6ujrxl+wQfbYWXh5j5ufn3333Xe/mSePu3buhoaHezfOLL744cOBASEhITk7OV199JTkfX8SG2XLaMnPr6+srKCjwNJ/Hjx9XV1fHx8cHBwfv27fvvffeW11d5S/3KQp79+596623VlZWaCFRk+3atSshIaGlpQXnLE1tyQJSi3v06NHY2FhNTQ01gTTpuHjjjTeCg4M7OztZ1UC8/PLLPDncuXPn5Zdf3r17d1RU1OnTp+fn55kVkawGrmxNTY3BYPDoEh4++uijZ555Jjg4+Jlnnvnggw94UoqJ/Ck2xIS64yC9yvT0tFKp9G6eTFwul3czjI6Ovnr16uzsbFNTU2ZmpuR8fFr9LactM+CsrKzPPvvM03yOHz+u1+stFsuDBw8MBkNubu7w8LBguS6Xy+VyLS0tjY2NZWdnv/322+i/uIK0ZCaTKSsrq7m5mSt4MUhuI+qFrJlIk44Vh8MREBBgMpncbjerGojl5WWeTBITE8vKyux2u81mKyoqKiwsFFkRMeDKis9BUJ+enh6tVnvt2jWHw3H9+vWkpCTc1kzElItUslgs4eHhWDQxoe40tuQY43XUarXNZiNJ8tq1a2lpaZLz2QZjjBex2WwZGRn40G63h4eH839zMVlaWpLJZHNzc+IvYQo1ODi4f/9+MclSUlK4/iutaAkXMjORJp2YsvhPcuFyuc6dO7ewsIAOx8bGtFotMx9palArKzIHMfpotVrqIDQ6OqpQKJxOJ2ti8ZFPT0+Hh4eLSbljEV4rW11dfeutt6KiokJCQk6cOPHo0SOCIG7evJmTkxMcHBwZGXnixIl79+4RBDE/P6/T6ZxO51NPPfXRRx89efLk9OnToaGh8fHx77zzDl6FuH///tGjR0NDQxMSEjo6OiIiItD5xcXF1157LTIycu/evX/84x9RejRpfffddyMjI/fs2fPhhx9Sp7FcRdy8efP5558PDQ2NjY39+c9//q9//Yu/jhUVFXl5ea+//npDQ8Mnn3xC+y8zN9pU+u7du7gWBEG89957UVFRERERp06d+u6773yhLVfdN5W2sbGxIyMj+LCvr++ll156+umn0eHf/vY3vib5f4K1tTWCIGQymXgBmcjlcpfLRQitgcjlcrfbTTDU5gqVtaVoMGVkys5sXBpYumPHjr3//vvo5O3bt4OCgvAi1Wuvvfbb3/5WMMGjR49wWdS1MoIg1tbWqquro6KioqKi3njjDRzq+++/T+vPQUFB1dXV6NqVlZVLly4dPnyYqRvKlvlxQNl2dHQkJCRERES8+uqrOEiC0U+4oDYK9RLW/jk/P2+z2XJzc/ElBw4cuH79OsH2KaCWwqUAIB7hMaatrc1gMBgMhomJiZiYmPHxcYIgRkdHz5w5MzMzYzabtVptZWUlQRC7d++2WCxoxl1cXNzc3IxWKgYGBoxG44ULF1CGlZWVgYGBk5OTBoPh448/xgVVVVXZ7fbR0dGBgYG+vr7u7m503ul0WiwWs9nc29t76NAhamxcReTn55eUlFit1sHBwUOHDsnlcoIgIhngfJRK5dTUVG9v78DAwA9/+EOaAqy5ceF0Om/9n9HR0ba2Nl9oy1V3f2nLLy+CtmJeUlLy4osvUgchzM2bN1988cWSkhKCIEJCQvLy8goLC7/88svFxUUxAtKYn59vamrKy8vjaQiCIB4+fPj222/r9Xqm2lyhsrYUDVYZabIzG5cGli4/Px/fn7h27dra2trAwAA6NBgMeXl5ggm+973v4bKOHTtGLWVpaUmpVJrN5qGhIYPBcO7cORTq8PAwV3/+61//qlAohoeHe3p6mLoR3B8Hp9M5NjY2NDQ0PDxstVobGhqYleWC2j2Yl7D2T6fTKZfLaePWs88+GxISwmwOWnH8CgDCCM50NBrN6OgoT4LJycno6Gj0N3WOqVar8VQULXaTJOl2u+Vy+dTUFDp/5coVNNN0u93oix6d7+vry87ORhkSBDE7O4uLEyxidnZWJpMx10ZtDND5ixcvpqWlzczM5ObmHjlyBNVIo9Gg/7LmRptK4/kyitZqteLa8d/dkawta939qC3JLS/C6XQqlUpqWU6ns7W1VaVSnTx5cmJiAp2cmJg4efKkSqVqbW3FpS8sLNTX1ycnJ8tksqSkpKamJrfbzSMgqpf6/wQGBhYVFaHcaCs5OJlKpZLL5eXl5bT7Ezyh0kAtxVxjYcrIlJ0ZGDUTqnR2u12hUKAgs7Kyamtri4qK0CVhYWHLy8uCCaj5UwtyuVw3btzAhV69ehWHytOfl5aWjEZjamrqhQsXWCvCejk6j5faBgcHExMTmZVlSsHaPaiXcPVPnrUv/uYQVADWygQRGGPm5uZkMhn+SGNGR0d/8pOfxMTEoM8nVhm3zezsLPVzrlKp0Le23W4PDAzE+YyPj6NraecnJibQdyuzcwgWQZJkYWFhenp6bW1te3v79evX+euIv6fsdrtarW5tbb1x40Z6ejpOwMyNZ4yRy+XU2uGQ1BTWqS1X3TehtpgrV64cPnyYeX52dlav18tkMnQok8n0ej3X3ReXyzU0NIRv4HMJOD09rVAo0DjX29sbHR29tLREqyAtmd1up+XDFIcWKsnWUrSrWGUUvB1CS0CTLj09/fPPP5+ZmdFqtXNzcxqNxu12X7x48ZVXXhGZgHWMoWGxWNCQydWfqfT39+Mbb7SKsF7O9fFhVpaWkrV70C5h7Z82m40aCRX+5hBUAMYYQdiXuWns2rWLdkav15eVlV24cEEul9tstiNHjtASuFyugICAW7du4ZX0gAAvPyfNU8Rf/vKXkZERs9lst9tra2ufe+65Dz74gLl68/Dhw4cPH87Ozh44cIAgiD179vT29ur1+lu3blGnzMzcRD6zT8VkMrGel6Atf929gqfaEgTBKi/+m3UB5N///ndjY6PRaGxubkZnmpub29vbKyoqmpubv//979PSBwUF5eTkdHV1FRcXt7S0oJNMAVG0sbGxBEGcOnWqvb394sWLv/nNb3iSCcIMlZD6KVheXhZTIoYmXV5ensFgmJqays/P3717d3p6utFoROtgIhOIBN0JY2VlZcVkMj377LPoMDEx0W63e5Q5F/wLZazdg3YJa/9Ey3crKyvU5bKRkZH9+/d7JWyAD8FRSKPRmEwm6pkHDx5Qf82ZTCbW39pKpZK5joHWc6anp9GhmPUcrt/aXEXQMJlM6KEX1sUcFA91AeTMmTMEQZjNZp7cFhYWAgICqJN91rWyq1evCq6VSdOWte5+1JbkXStzu91qtRoHgCgvL1cqlbW1tQ6Hg3re4XDU1NQolcry8nJ0hvbwj9FoxEsrTAGZ9fr000+1Wi1aPxH/1BP1v6yhsrYUM0+mjB7NY5jSDQ0NZWVlFRQU9Pf3kyTZ3d1dVVUVHR1tt9tFJmCdxxgMBurc/cqVK8y1MtyfXS6XTCbD60t9fX1oKZVZEdbLueYxzMoytaJ1D9auhaH2T61WazAY8L/MZjN6rkxwHsP/iYZ5jCDCY0xra2tWVtbY2JjNZqusrDQajSRJajSa7u7uubm5iYkJvV6PVXY6nTKZDH1ll5eXZ2dnox8UbW1t+Gl09LrD9PS02WxOS0vD15aVlRUUFFitVrPZnJGR0dXVRQp9D7IWMT4+fuTIkc8//9zhcFit1rKysvz8fJ4KVlRUPPfcc2az2eFw9Pb2qtXq6Oho/DoFV25ZWVllZWUzMzMTExOHDh2ijjHHjx+32Wxmszk9Pb2pqckX2nLVfbNpi0BL9rSTxcXFeDhkMj09XVxcTJKkxWLRaDQ9PT12u31ubg5l1drayiMgs14pKSnohoH4MYaqNleozJZaWFiQyWQWiwWvvDFlZC2XWpzVasXrM6zSaTQajUaDRk2bzRYWFkYdHgQTsI4xc3NzarW6sbHR4XCMjo6mpqZ2dXXx9Of8/PzCwkKbzWYymVJSUrq7u5kV4bqca4xhVnZycpL1Gxx3D9olPP2T+n6M0WhMSUn505/+xAyGKRH/JxrGGEGExxi32/3mm2+q1Wq5XK7X69FPOaPRmJmZKZfLo6Oja2trqSo3NTUpFIre3l6Xy1VTU6PVahUKRV5eHv6tMTMzk5+fr1QqdTrd2bNnqd+hZ86cUavVWq0W39fl/x5kLWJ5ebmpqSk5OTkwMFCj0RQXF8/MzPBU0OVy1dfX63Q6uVyekZFx6dKlqakphUKBvrC4cpucnDx8+LBSqUxJSenq6sJjjFKpbGtr02g04eHhv/zlL/GdAO9qy1X3zaYtoq6urqGhQTAZF/39/bm5uWFhYQqFIi0traenh19AZr0uXbqk0+mWl5c9enuDqjYrrC1VX19PvYopI1e51A8OnluzSldUVHT8+HF8mJmZSUvDn4DrfgxaIlYqlYmJiW1tbTjB2bNnmf35wYMHhYWF4eHhWq0WfVkzK8L1ceAaY5iVvXz5Mv/7arRL+Ptnb2/v/v375XJ5cnIy+pnFDIZVIlYFaMEDXHj5HUxPQb9S/RvDdmXzaJucnEx9ZgkQpKqqCt3H9q90gsOwd6FV1uVy6XS6ixcvir/E62ywAtsSUff8fYfJZEpMTPRvDNuVzaPtnTt3/B3CFqO9vR09JLKjpKNVNigo6NKlSwcPHhR/CbAJ8YPvcktLy4cffvjw4cN//vOfDQ0N5eXlGx/DdgW03R48/fTT+KmtnQbVov/gwYM7xLF/G1fTD2NMbm5ud3e3VqstLi6uqqo6derUxsewXQFtgS0NzaJ/hzj2b+9qSh9j+P3weazRn3/++ZGRkSdPnnz99dfV1dWSAxAZiXehWZNtNqjapqenb5gsEtiArQrWw0Z2Kml4V0BWJ7f4+PjHjx/zJOAKRnJstJddvLujgQSwAp7WyKN9DXA1v/3221/96leRkZGxsbG/+93v0IYUWx7Jd3L4/fA38l6Zt5z5xbCFHiPZSFkksMnvpm5y9UhvCyiYm/jXidYTG82i34s7GqwTT2vkUXpczYKCgqKiIpvNZrFYDh06VF9fLyXWTYb0eYzb7c7MzIyIiMjMzPT01WXvsnki2VSALOsB1Nt47t+/PzExgd2RaYfbFVzN7777bnR0tKenJzY2dt++fZ2dnZcvX/Z3dN5AcBQaGBhgPd/Y2JiWllZRUZGWlkZ7K35ubg7nj14UGB4ezs7OlsvlarUavdBEkqTdbs/Ly0Mvc7S3t+P5wfDwMHpOPyYm5pVXXhkfH+ePkCcS/if0W1tb0RuX6PlI1pdISJK02WwvvfSSUqlMTk5ubW3ln8egnNvb23U6XXh4eFFREbZXYhWBml6hUJw8edLhcNTV1SF7q5KSEvyWu8vlKi0tVSqVcXFxjY2NTJ8u8bKQJOl2u+vr6zUajUKhOH78uMPh4DFho2nFqh5reFxqMHsIj5is7xuxiklydyp/qbceAXn6kkcCim9THkFQgnPnzul0OpVKVVxczBUM9bCjo0P8G2MXLlw4efIk81Cv16P3dUiSNJlMgYGBuOgzZ84kJSXx/Leuro7/8rq6OmoMrP2EqTZXN2NVnqdvMGuN+eSTT1544QVPX7nbhAjPY7iMzZXcfvhMi29WF3QuI3pP3eN5IiG4rbmZht5cBviVlZVhYWHj4+P9/f3M3WWYcPmWc1nBO51Ok8k0ODhoMpnsdvv+/fsdDsfY2NiNGzemp6fx5awu8ZI3LBDjik+tEU0r5hmuvQBY1RB0s6cWzdp8XGJydSqu8KR1Ko/UW4+AXH1JvIDiQ6LCKgvqqCgYu91eX1/PGgz18NixY+K98bluxvBvWKDX69e53wE1BtZWYKrN1c0kwHrP6c6dO3V1de3t7cQ22FxAcBRiNTbn98MneZcjkQs6lxG9p+7x/JFM87qLUw29uUy9UJzUHATnMQSHbzlTBJwe/7AaHBwMCAjAP1WGhoaSkpLQ36xm+9I2LCDZXPF5fvMSjC0ACIYdOmt4PGqIWbDmaj4uMbk6FVd4XAJ6Ub31CMjfl0QKKL5NqSmZstCCGRoa4gmGy++L2oJWq1Wn0+FLaK7+4nc0sFqt69/vgKcVmBXk6WasgvD0DeaeF0j8xMTETz/9lF/ArYLYe/40Y3NBP3yarEwXdC4jetKrzvzT4tzFSW4DfLvdTstBzFoZ9RCnZzXt559H40Mes30JsrC64vOvq/Ck5AlPcAWJpwokd/ORHGJydSo/qsdaU5ECCvaN9YwxgiGJzIrrv3iM4WpBt9uNbTpJhkW/RzsarH+/AwRPP6FWkOe7i1UQHulY97zIzs6mWt2I2V5hMyPqPX+asbkYP3waYvzqMeLd48fHxz2NxI94JAINLrN9yRsWEByu+NLYgK0caHgkJk94kjuVF9XjitCPzxowZbl165Z3i9i1a9eePXvwIf9Ty/wbFnhrv4ON78bMhbL79++PjY394x//8Gm5G4rgKMQ0Nhfjh08dulld0LmM6Gnwu8cLRjItzl2cFL1WdvXqVWnzGC7TfpHzGJLDbJ91qUdMAzFd8Xk2LBDzm5c1vPXPY1ibj0tMnk7FGh4pqVORnqjHWlORAq5/HiO5TVnXyqTNY1hbkAbNot/THQ3Wv98BhqufMNfK+L+7qOm5WoF1YwK3203b3UCMgJsZ4TGG1dic3w+fZBjRs/rVsxrRe9eZf1qcuziC1QCfJEm9Xk/NQfJaGasI4scYrr0SJMhCcrjic21YIOYrkjU8/pVoag/hEpO1+bjEJLl3N/CXeusRkL9viBGQKypmAMxdCWh4FAw+5GlBkiTxbVeaRb+EHQ3Ws98B9e4vVz+hVZCrm+GsaHqytgJrNWnx8Au4JZD4Dia/Hz6Cao3O6oLOakTvXWf+aQ5rbtYPuZhnl1mfU6TC81FkFUH8GMO1V4IEWUgOV3yeDQt46sgTHn/tBM3zuZqPS0ySe3cDf6m3HgH51RMjIFdUrAHQdiWg4Wkw6BA9u8zagtQMaRb9EnY0kLzfAa1ePP2EWkHWbkbLiqonayuwVpN1gsizucDmx8/e/hgfGdGLWU8ANi3rbL7Ns7vBjkVkC9Is+rfWZhCSu5mYam6DbzA/e/tjNo8RPbBtgE61VaBZ9G8tx37J3WxrVVMy/hxjWlpaYmJiCgoKpqamGhoaGhsb/RiMpzAfvEFMTU2J98IDEFxifvHFF55mtaU7lWSgN24wO7ObScOfY0xubm5NTU1FRUVcXNyWM6JHW0gxgY+0BLjEdLvdnma1pTuVZKA3bjA7s5tJxI/rdFxLjczbiVwsLCxER0dbLBZ0ODs7W1xcrFKpYmJi3nzzTeobvNevX09PT1coFNnZ2WNjY2LC2OSw3klGui0sLFRVVcXFxaGty8+ePStozwUAAOAL/LBHGSY+Pt7hcKwnh66uruLi4n379qHD0tLStbW1sbExg8FgNBpbW1txysLCwqamJvSyXmlp6bri3vSUlpZardbPPvvMarV2d3cPDAyMjo76OygAAHYk/h7kWBA5j1lYWEhNTcVvNrlcLplMRjX+SklJwYnVajV6P/HatWtpaWm04rbTPGZpaYmqAwAAgB8RnsfcvHkzJycnODg4MjLyxIkT9+7dIwji/v37R48eDQ0NTUhI6OjowFtDPnny5PTp06GhofHx8e+8887q6ipPztSt4u7du/fTn/40NDR03759YryNCYI4f/58XV0dzsHlcq2trQUGBqJDuVy+tLSEE1dUVOTl5b3++usNDQ38+bPWF4Xa0dGRkJAQERHx6quvzs/Po/RcUnDBlIgncwmsra0RBIHNMAAAAPyI8BjjkS0/l4O6IFz++VzW64uLi52dnc3NzbGxsb///e9XV1d3796dkZHR0NCwsrLy+PFjtH0hzoffql2wvgS3yzqXFFyRe2ThLoGQkJC8vLzCwsIvv/xycXFRcj4AAABewKNZD78tP8ntjM0KXu3h8c9n9eMiSbK9vR29Xz05OZmamop8X8bHx9PT0wMDAxUKBUEQeJdWQf9//m0IyP87OjBd1nmk4IrcUwt3QfWoZ/A9//r6+uTkZJlMlpSURPUsAAAA2EiExxjxtvyeOqjjb0lP/fNJkkxOTsZjUl9fH9Unbm5urrOzk3pG0P+ffxsCZhr8bS7G5ZuKBAt3LnjGGIzL5RoaGsrOzqZ6bQEAAGwYwqv24k3UfeGMzepd/+23305NTe3duxedSU5OttvtOIFCoTh37tz58+dxeo/8/9fjwC8YuRct3NG2S6urq9hk3ul0ogkcJigoKCcnBz1919LSIqEUAACA9SAwxjx8+NBut//hD39Ah+hRY41GExAQcPfu3fj4eIIgLBYL+u+ePXsUCgX+QhePRqMhCOK///0vGjYmJibwv1hfLlMoFGtra//5z38SEhJQAHFxcfi/yCj3Zz/7GTpUqVQymezrr7/+wQ9+QBDE0aNHS0tLe3p6zGazyPryR84qBVfkrBLdvXuXvxRWIiMjVSrVjRs3Dh48iM4Yjca0tDSCIBYXF0NCQnBKl8sl4WVGAAAALyA40xFvy0966KBOXe3xyD8fpT9y5Mj09PTY2FhKSsqf//xndN7tdicmJvb19VET81u101y4PXXg55KCC08t3Hk4f/58cnKy0Wh0OByXL19WqVSDg4PIoa+np8dut8/NzSH/8NbWVjEZAgAAeBfhMUa8LT/poYM69bvVI/98kiQdDkdRUZFKpYqLizt79iw+//HHH2dkZNASC1q1U124PXXg55KCCwkW7jx0dnbqdLrAwMDU1NQrV66gk/39/bm5uWFhYQqFIi0traenR2RuAAAA3uUpkiTXORO6c+fOCy+88M0333hlXrWlASkAAACoeMFLBhzUMSAFAAAAFYlvg3tkbb29jcd96vK9vaUDAGDbI3Gt7O9//3tNTY3ZbI6Li6usrKyuruZJjOxYmMTGxkooerPhkRSesr2lAwBg2+OF+zEAAAAAwIo/vf0BAACA7Q2MMQAAAICvgDEGAAAA8BUwxgAAAAC+AsYYAAAAwFfAGAMAAAD4ChhjAAAAAF8BYwwAAADgK2CMAQAAAHwFjDEAAACAr4AxBgAAAPAVMMYAAAAAvgLGGAAAAMBXwBgDAAAA+AoYYwAAAABfAWMMAAAA4CtgjAEAAAB8BYwxAAAAgK+AMQYAAADwFTDGAAAAAL7if66sKxRqE8YAAAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAOtklEQVR4nO3dX0xTVxgA8GvpsIXyT6AqlvEnBHExqJMxWNARly2ONYRsiMZ1k2WELQaVEWYYD45pNhRjsjFDjMsW8GXJHggh22IM2QwwsyBgxYKlEgflT1lXmMWChVW6h5Pd3N17zrm34C0Uv99Tezk95zvfPddjb8vHOq/XywAAAAAyUKx0AAAAANYs2GMAAADIBfYYAAAAcoE9BgAAgFxgjwEAACAX2GMAAADIBfYYAPwtKSnp9u3bKx0FAP4AewwAfnXnzp3FxcUdO3asdCAA+IP4HrMOJywszA/B+ZPT6aytrfXbcCMjIzLl0A8TkS945KOPPlKr1U1NTdyD3HnJHQCJxHHpp6C1tTU/P38J3frKP1kijeLr6H6+AIH/eMW43W632202myMjI9Fji8Wi0WhEXxhYhoeH/Tkp+Ybzz0TcbrdMPTscDoVCYTQaPR4P9zh3Xn4+WVxSJk4PLzMz89q1a0vo1lf+yRJpFF9HX8FzCmSlFN2E1q9fzzCMSqViHwcHB8u984FVDq0EObhcrpCQkFV7K2mZE7fZbBaLJTc398l2C8CqtfTPY7766qukpKTo6Oh33nnH6XSyx+fn599///2wsLCEhIRPP/308ePH3Fehd9Dnz5/fuHFjVFTUkSNHHj16hH508+bN7OxstVodGxt74MCB8fFx1Li2tjY2Nnbz5s3ffvstthnb7YULF5KSkkJDQw8ePDg1NfXxxx/HxsZGR0e/9957s7OzlPCcTmdiYqLL5Vq3bh26RSNshg2G6+bNm3v27AkLC9uyZctbb7119+5d3u2CkZGRqKgo7kvOnTsnzIPQ48ePP/nkk40bN4aGhh44cGBqaoqUBykTQX3abLY33ngjLCwsKSnpwoULbGCzs7MffPBBbGxsfHz8Z599hp04b16kIYQJ4U5KOBDDMFNTU7z4EeG8SCuQvvwoUQmTTJ84aSVjQ2W1tra+9tprzzzzDPcgt1t60g4ePPj555+zT7Ozs5uamkSXGfP/CyQqKurtt9+mX7PSLz1EdCXTz4swadjlAQLREvcYl8tlNBpv3LjR1dU1MTFRVVXF/uj06dNzc3N9fX1Xr15tb2+/dOmS8LVdXV3d3d3d3d29vb11dXXoeG9vb2lp6eTkpMlk0ul0ZWVlqLHZbDaZTI2NjTk5OaRmbEidnZ1Go3FiYiItLc3hcPT19f3+++/Dw8PV1dWU8CIiIsxms0ajcbvdBoOB1EwYDJdery8uLrZarZ2dnTk5OeidHz2H3f/h5kGorq6ura2tra3NYrHExcUNDAyQ8iBxIgzDlJWVBQcHDw0NtbW1XblyhR3r+PHjExMTvb29V69ebW1tbWhoEJ04aQh6QrADRUdH8+JHhPMirUDR5UeKCptk+sSxK1kYKpfwwxiJ4SFFRUUtLS3osc1mMxqNBQUFlN540fb19aGMWa1W9oogJc2nS090JdPPizBp2OUBApLEe2rDw8ORkZHsY4ZhZmZm0NMbN24kJyezLWNiYlwuF3psNBozMzN5/TAMY7Va0dPm5uaMjAzhcENDQ5s2bUKNp6enSVGhZmy3Dx48QMc7OzsVCsXc3BwbYUpKCj083u1gYTN6MNPT00qlkndXndenMIeieUC0Wm1vby/pp9w8SJmI1+v1eDwqler+/fvs6Cgwj8ej0WjY462trVlZWcKJSxkCmxAWdiBs59hBKSuQvvwoUQmTTJ845QySpuByuTQajXAJse3pSfN6vXNzc+Hh4WjQhoaG/Px84XDsMqNkrLOzk37N+nrpCfMgZZFgk+ClLg8QcMQ/j8HSaDTs2/O4uLjp6Wn0+O+//3Y4HImJiejp4uKiUskfQqVSxcfHo8dpaWlWqxU9vnXr1smTJwcGBhYWFhYXFxcXF9FAvDf+2GaoZUREBHqs0+nCw8PVajUbocPhkBgepZkwGFZUVFRhYWFWVta+ffvi4uIyMjJefvllcv5oeYiNjWXb/PXXX06nc3p6Oj09nfdyUh6kTMRuty8uLiYlJbGjowd2u31hYYF7HP0LQpk4aQh6QkgDSYddgaLnlxQVKcmUiTPkM0hy7dq1zMxMSoeiq0itVufl5bW0tBw7dqy5ubm4uJg+Im8ubMZ0Op3oNSv90hPNg8TrjrX85QFWjyXuMSRut1uhUHR3d7NrSKGQejuuoKCgpKTk0qVLKpVqbGxs//79y2m2nPCwzRYWFuidf//99z09PSaTaWJioqKi4qWXXqqsrJQeG8toNAoPBgUF8Y5IycNyTodElCGECfn666+f7OjSg2FRohIm+ckSvVFGDw8pKiq6ePGiwWDo6upqbm5eflTSV/uSLz0/rEOwekl8v8O7z0O6BeT1ejUaDeXGDu+ddUtLC3pnbbfblUol28xoNEZGRgrvOWCbiYbEfUoKj9eDsJlP3600Go06nW5mZkahUHBvUJDulbF5wNJqtUajkXuElAcpE/H+d69seHgYPRW9V8abuJQheFBCuAEs814Z6XRLCQYblTDJ9IlTziB2Ch6PJyYmhp0yfSBheCy3271hw4Yvv/zyzTffREdIy0xixrzSVjvl0sPmwddFAvfK1qonv8d8+OGHWVlZ6D9idXV1p0+f5vXDMExhYeHY2JjJZNq5c2dNTQ36kVarbWhoePDggcViKSgowO4x2GaiIXGfksJzuVxKpdJisZCa0feYgYGB/fv3//LLLw6Hw2q1lpSU6PV6r9ebmZlZUlIyOTlpsVhycnJ4eww2D0JffPFFZmZmX1/f2NhYWVlZe3s7KQ9SJoKOFxYWFhQUDA8Pm0ym9PR09uUlJSX5+flWq9VkMj3//PP19fWiewx2CFJCWMKBsJ2zuPOinG768qNEJUyylD0GewZ5pwBpb2/fvn27cF7cbkWThhw+fDg8PPyHH35gj2CX2czMjFKpNJvNHo/H12vWp0sPmwfu6KLnRZg00vIAAefJ7zFut7u8vFyn04WEhOTl5fH+44Zee/bsWa1WGxkZ+e6777KfzLe3t2dkZKhUqk2bNlVUVJD2GGEz0ZC4Tynh1dTUhISENDY2YpvR95iFhYWamprU1NTg4GCtVmswGCYnJ71e79DQ0L59+zQazXPPPVdfX8/LYV1dnTAPQh6P5+TJkzExMSqVqqCgwOFwkPIgZSKozeTkpF6v12g0iYmJZ8+e5W5RpaWlMTExOp2upqZG+M+TMNvYIUgJYQkHwnbOxc6Lcrrpy48SlTDJonsMaSXzTgFSWVlZXV2NnRfbrWjSkJaWFo1Gwx2OtMyqqqpEM4ZNmq+XHnYls6OLnhdh0kjLAwScdV6v15+35kZGRrZv3/7w4UN/DgroBgcH9+7d++eff650IIHE15W8devWK1euvPjii7JGBcBq84Q/8weByGg0Jicnr3QUa9zg4OBKhwDACoA95il15syZuLi4/Pz8+/fvV1dXnzp1aqUjAgCsQfANwqdUbm5uQ0ODTqczGAzHjx8/cuTISkcEAFiDJO0xTU1N27ZtU6vV27ZtW+avOCQkJCzhw5iHDx+eOHEiISFBrVZv3br13LlzbEklto2vtcGxfUp/uZTS5auhHD3Jnj17enp65ufn7927d+LEiZUOJ/AsbSUD8NQR/VbA5cuXdTrdjz/+6HA4rl+/npKSIvzeodzQF23NZrPdbm9ra8vNze3q6vL+vyK6r7XBSX1KJ1qPXfj9K5/6BwCAQCf+vbL4+Pjvvvvu1VdfRU9v3bqVk5Njt9tDQ0Pl3wEZhmEePXoUHh7ucDjYUjFYPn3PR2KfywRfogMAPOVE7pU5nc6xsTHun7vYtWvX9evXmf9u/vCqf5MqcmMrltPLmLNQWSRhgSPu3SfpNe3pfTKEQvqUMu8Sa7wLy8JjC62TSu4DAEAgEtljXC6XSqXi/bmLF154Ab2JEVb/JlXkxlYsl1gMPzQ0NC8v79ChQ7/99hv7Z2B4pNe0F+0TW+MdO1lulnyt8U4qtE4quQ8AAAGJfiuN8iGHsPo3qcoQtmK5aBlzrpmZmaqqqtTUVKVSmZKSgv39c19riWP79BIK6VPKvEus8S6l0Dqp5D4AAAQokd+PUSqVHo+H9FNe9W9SRW5sxXJSGXNeZXv0AN2nqq2tnZ+f7+3traio8Hg8JSUlpMCk1BLH9llZWYmt8S6cLJevNd4ZQqF1Usl9AAAIUCJ7DLrV888//3Bvl/X09Pj6zx+2Yjn2ILayPWv9+vXZ2dn19fUGg4Gyx/hUS5zbJ6rGL3eNdwAAeEqI7DERERE6na69vf2VV15BR/r7+/fu3Wu324WNtVptcHDwH3/8gf4nbjab2XcSDMPs3r179+7dDMPk5eXp9Xr0ezbCg1u2bBH2PDs7y/0am9vtpry7Yhhm8+bNISEh09PTu3btIrXB9hkREbFhw4bbt2/v2LGD0j+P2+0eHR1Fb2UsFsuzzz4r/bVcWq1WoVCMjIwkJCQwDGM2m5fWDwAArBLiv4N56tSp4uLin376aWpqqqOjo6ioqLq6GvvF5aCgoEOHDpWXl4+Ojvb399fU1Bw+fJhhmLt3777++uu//vrr1NTU6OjoxYsXd+7ciT2IDWBwcDA5Ofmbb76x2WxOp7Ojo+Po0aPCNzExMTFut/vevXvoqcFgOHr0aH9/v81mO3/+/JkzZyT2WV5eXlpaeufOnfHx8WPHjnV0dEhII1NRUTE+Po5mrdfrsSGJCgoK0uv15eXlIyMjqCuJLwQAgFVKyoc2jY2NaWlpKpUqNTWV/nc+sBW5sRXLJZYxR37++efc3Nzw8PCQkJD09PTLly9jA5BS057ep5dQSJ9S5l1ijXeJfzCKVHIfAAACkb9r+6898v2iJZTcBwAEOqiJuXpByX0AQKCD2v6rC5TcBwCsJfA+ZnWBkvsAgLUEPo8BAAAgF3gfAwAAQC6wxwAAAJAL7DEAAADkAnsMAAAAucAeAwAAQC6wxwAAAJAL7DEAAADkAnsMAAAAucAeAwAAQC6wxwAAAJAL7DEAAADkAnsMAAAAucAeAwAAQC6wxwAAAJAL7DEAAADk8i/J4d50YfSH1AAAAABJRU5ErkJggg==)

Screenshot: etg.lu  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 24 September, 2020 17:39 GMT
Vulnerability Verified: 24 September, 2020 17:55 GMT
Website Operator Notified: 24 September, 2020 17:55 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 24 September, 2020 17:55 GMT
Vulnerability Fixed: 24 October, 2020 04:45 GMT