Lucene search

K
openbugbountyBroly157OBB:1383036
HistoryOct 05, 2020 - 11:54 a.m.

rosi.it Cross Site Scripting vulnerability OBB-1383036

2020-10-0511:54:00
Broly157
www.openbugbounty.org
8

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: rosi.it
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: Broly157
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nO2dfVAU5x3H1/OE4ziQl7sTgchLUrQONTeWEmyIpdqxKV6Zi8GXUqIYHTXWkCuDCVBrCHGQoBDjOJRxNIOObW0ndSzjOJih2qGUiUDIiVc8LwbhPA9KDjzw1BMPtn88k53t7rN7e2/Awe/z1+2zzz7P93nZ/d0+u/v7zSNJkgAAAAAAPyCabgEAAADArAVsDAAAAOAvwMYAAAAA/gJsDAAAAOAvwMYAAAAA/gJsDAAAAOAvZq6NSUpKunHjBtfmLGbutHR2EyjjGCg6sQS0+DnCDLUxN2/enJycfPHFF7Gbs5i509LZTaCMY6DoxBLQ4ucOLmxMf39/WFgYdtfo6Ojhw4e5Nr2ksbExJyeHa3Pmg+03RiK2x6a3pcKH24PSHjx4sH37doVCERcX99577z179swrre5U7cGB/f39kZGRHgvwfhwFNsHL847Syajut7/9bUhIyJkzZzwueQqgxNM7gd4QrnRgSiF56evrk8lkQnbx5PSA9PT0zz//nGszIHA4HPyJ2B6b3pYKH24PSsvJycnLyzObzQaDITMzs6SkxCut7lTtwYF9fX0REREeC/DJOGKnEAMvzzu6Tqo6q9UqEol0Op3T6fS45CmAEs/oBKoh9HTfXqAA4czEtbKBgQGj0ZiVlYXdDBSCg4MFJlIEaEuF8OTJk66urpMnT8bFxS1durS2tvazzz6bblEYxGJxSkoK/YcH+Goc+WeL9zB0UtXZ7XapVPriiy/Onz/frwK8gaeT/d1vgFsIsjGffPJJUlJSdHT0G2+8MTo6ShDE6OhoYmKi3W6fN2/emTNn6Ju1tbVhYWFHjhxZtGhRZGTktm3bnjx5gsrp6Oh45ZVXwsLC4uLiXn/99Vu3bmGra2xsXLdu3YIFCxibr7322pEjR1DijRs3goODkRiCIHbv3r1//37+DN/73vf4D6drQHfWhw8fVigUixcvPn36NEEQjx492r17t0KheO655z744IOJiQmuRrlcK2N0ILvhExMTpaWlixYtCg0N3bhx4/DwMEEQT58+3bFjR1hYWEJCwvvvv48EYKViD+/o6Fi1alVISIhCodi4ceP9+/c9G25UY01NTVJSUmho6ObNm4eHh/fv369QKKKjo7dv3/7o0SNGmSEhIffu3QsNDUWbd+7ciY2NReVwTRW2VOGDwkBgwwmCiIuL+/LLL9GP69evo8QrV65w5cdmoI8jdnqwR4fdNPps4eoo9ixySypdJ1Xd8PAwe6wZfc7uT+FTAjuHhSjnEo+dnNjOocMlA/A5rm2M3W7X6XRtbW3t7e0Wi6WkpIQgiIULFxoMBplM5nA48vPz6Zuvvfaa3W5vb2/v7Ozs7Ozs6uqqrq5GRanV6oKCApPJ1NrampmZKZFIsDVyPYxRq9XNzc0o8dKlS5OTk01NTWizubk5OzubP4NGo+E/nN1wg8Gg1+sbGhoyMzMJgigsLLRYLF1dXU1NTY2NjXV1dcIbxYDRgeyGV1dXNzc3Nzc3G43G2NjYnp4egiAqKioeP37c3d3d1NTU0tJSX1/PJRV7eFdX165duwYHB/V6fXx8/L59+9jChAw3la21tVWn01kslmXLllmt1u7u7i+++KKvr6+srIyn7bdv3y4uLj569CgqBztVuKQKHBQG2NIULLgEFxQUrF27FtkeBh0dHWvXri0oKKAn0scROz2wo8NuGmNc2B3FHhe3pGIfGkVHR7PHmiEM258CpwTXHOZRzi8eeyrxpPPLAHwP/1JaX18fQRBjY2Nos62tLTk5mdqFfR6DDjGZTCj9woULaWlpJEmOjIyIxWLsErPJZEpMTES/7Xa7TCYbGRlhb1osFqlUikpIT08vKirKy8tDNYaHh4+Pj/NnMJlM/IezG07JIEnS6XTKZLLe3l602djYmJGRwdUo7OIv/xMsRsOVSmVXVxejBLlcbrfb0W+dTpeeno6VynU4nTt37sTExLAVChlulM1ms6HN1tZWkUj0+PFj6qgXXniBqxPMZnNycvL58+dJ7qnCJVXgoHBVzSjNzIKrr+x2e2VlZVRU1KZNm4xGI0o0Go2bNm2KioqqrKykBoX8/3Hkmh7s0WE3jd3h2I5izyKBUhnzjevRBXZ2sftT4JQgOeYwl3LvxXM9j+GSAfgc95750x+E8tgYiURCpff09CiVSvR7y5YtKpWqqKjo6NGj//znP6k8TqfTYrGg3xcuXFizZg21i7GpUqmuXr06ODgYHx9vs9mUSqXT6Tx16tSGDRuEZHB5OFfDSZK0WCxBQUHUptFoRJcqbKM8sDH0ltpsNrFYzHjiOjIyQhCE/DuioqJQx7Lrwh5OkmRXV9fPfvaz2NhYdDj7mbbA4ebJRt/EdkJGRsbx48epnFxTBStV+KAwcrpsuBBGRkY0Go1YLEabYrFYo9FQV1UKxoxlTw/s6LCbxuhwro7CdrIQqQydAi/NCHZ/CpwSXHOYS7kPxdN/u5QB+JApfeb/5z//+dSpUytWrBgfHy8qKnr77bdR+vz58xcvXox+87+1nJ2d3dzcfOnSJbVavXDhQpVK1dLSQl/p4s/g8nAfNspd2AsXjCeuDodDJBJ1dnbqdDqdTtfd3a3T6XgKZD+w1Wg0q1evbmlp0el0ly9f9kynNwwMDHR3dwvpIt9KxZYmfK2MIIhvvvlm3759LS0tFRUVKKWioqKlpWXv3r3ffPMNPSdjHHnmvJeN8lKqN29Xezw6/HOYrdwf4l3KAHwMvwny7D6GoN3XX7x4EbsAotPp4uPjGYlOp1Mul1NLH4xNkiTb2trS09NzcnIuX75MkmRdXV1hYWFMTAx1G8SfweXhXA0nuZdlsI1y9z6G3VKlUqnT6RglyGQy9goYti724UNDQ/S/hzqdburvY5xOJ72NXFOFS6rwQaHn5CpN+FrZnj17ZDJZUVGR1Wqlp1utVq1WK5PJ9uzZQ+lhjCMdanqwR8flfQzXOcU4UKBUtk7h9zHY/hQ4JUiOOcyj3FfiGQq5ZAA+x3MbY7fbxWIxtXJKbaLzITc312w26/V6lUpVXl5OkmRPT8+rr7569epVq9VqMpl27typVqupktGadUtLS2pqKpXI2EQolUqlUonym83m8PBwlUolPAP/Xuyb9RQ7d+7MyckxmUx6vX7lypXHjx/nahT9cK4y6R3IbmllZWV6enp3d7fZbEZ/7kiS3LNnT0ZGhl6vt1gs1dXVFRUVXFKxhyuVyrq6OpvNZjQaNRoNNZRcCrmGW+AFZWxsTCwWGwwG+roQ4wsh7FThkipwUNhVczVcIPn5+X19fVx7+/r68vPz0W/GOHJND/boCLEx2I5inIYCpbLnm1trZez+FG5jsHPYpXJ+8VyTk57OmBJcMgCf47mNIUmyvLxcKpU2NDTQN2tqamQyWVVVlVKpjIiI2Lp1K3r0Nz4+Xl5enpKSEhQUpFQq8/PzBwcHGbUUFxeXlZVR5TM2EXl5ebm5udRmWloaIw9/Bp69Lk8tu92+a9cuuVweHx9fXl7udDq5GkW/q+Mpk+pAdkudTue7774rl8slEolGo0F/7hwOh1arjY+Pl0ql2dnZ6K8cVir28JaWlrS0NIlEEhMTU1RUxL5wCxxu4ReUkpIS+gxh58ROFSFSeQaFXTW2NH/AGEeu6cEeHZc2hqujSNZp6IFObHXs3xTs/hQ+JbBz2C2wlwWuyUnvHPqU8F4GIBAXNsYDsJNSICkpKV988QXX5ixm7rSUjjdTZWbip3H0eUcF9HwLaPFzEPH0PAXi4Pbt2zybs5i509LZTaCMY6DoxBLQ4ucgfnmv7NGjR+BwGwAAAPC9jUH/MsDhNgAAAOB7G9PR0fGb3/zGJ0WBO+7ZTUJCwsOHD6dbRQAAHQUELr63MT6MgJKQkGC1Wn1SFAAAADD1zCNJ0ofFDQwMLF++fGhoiPKaDAAAAMxZXN/HeOwtnMuhuvAC6UEJBXoOHxgYWL9+fVhYWFJSUk1NDTaUIdvdunD3+Fju3r0bGhr61VdfEQQxPDwcGRl57do1/jYCAADMBVzbGI+9hXO5Z3fXUzpCoOfwffv2BQUF3blzp7m5+ezZs9gWYd2tC3SPT+D8XCUlJZWVlWm1WoIgDh48mJ2d/dOf/tRlxwIAAMx+XH5B47G3cDp0T/LCC2T4QHPpOdzpdEokEuqT3QsXLrC/6Ma6W+9zxz0+1s/V+Pj4smXLysvL5XI55b8AAABgjiP0O38PvIXzO1QXUiDWIwvJ7amC4em9p6cH6zWE7W6d/R01l3t8HlAANMpxPQAAACDovTLPvIXzOAAX7indHwj3xo91wM7lE35wcFAkEg0ODvpLNwAAQMDh0gp55i2cx5O8cE/p7t7HoLUyynsrdq2MAXK3LtA9PgK7Vmaz2WJiYs6fPx8VFdXT08NfKQAAwBzB9X2M3W7X6/U1NTXR0dH09Ojo6I8//liv19vtdoIg2traYmJikpKS0F6FQhEVFfWHP/xhdHT066+/Li8vd7dAD5g/f75ardZqtf39/f/5z3/olVLcunXrF7/4xbVr14aHh+/du3fixAmVSoUtTavV7tq16+bNm/fv33/77bf/9a9/ofQ4FgRBlJWVrV69evPmzUVFRXv37vVMPwAAwGzDV8aK7XDbe4fq7t7HkCQ5ODioVqtlMlliYmJVVRW7Uqy7deHu8bF0dnbKZDIUQsrhcCQmJp49e9bdxgIAAMw+fPYN5tKlS8+ePfvSSy/5pDSfcPv27dWrV//3v/+dbiEAAABzFJ/59p+BDrd1Ol1ycvJ0qwAAAJi7+MW3/zTy4Ycfnj59+ttvv71+/XpZWdmePXumS8mNGzfeeust9HtiYuKjjz76+uuvp0sMD2xtz549+9WvfjVd939Uv7FlHDlyJCkp6Y9//GNpaen3v//9v//971OgJykpyYeBKnxbml8JIKkMAlf5rGS22ZisrKy6urr4+Pj8/PzCwsJt27ZNl5KCgoLExET0e/78+ZOTk8XFxdMlhge2tgULFgQFBU2XWqrfGDKePHlSVlZ27ty5DRs2lJSUFBUVlZSU+FvMzZs3JycnfRWowrel+ZUAksogcJXPWqb7gdDswWazVVZWot9Wq1UkEtG9CTidzpUrV9JjxDY1NYWHh9NfJfjxj3+M3psYGxsrLCxcsmSJRCJJSUmpqqpCX4NypZPfuSpgcOzYMcYusVicmpp6/vx5unK2tq6uLsovAxb66xgu3+ag9wz7PQ56CYx+o8swmUxSqZQqs7e3Nzw8nL9e7zl06NC+ffvcaqzL0rzRIzDoMr3DPYPRcIRWq5VIJA0NDd6U7G+oTsbOOp50wE+AjfEZ9PkqcO5mZ2cXFhai3xcuXIiNjUV+dHJzczUajcFgGBoaam5uzsrKam9v50mnanT8P8gC0XcNDQ2dP39eLpdfunRJYFv4Mwi57GJ7BlsC+wVCri6dmqtDenr6559/7isbg0rzUhLDDRIW7zuHkkpVh8y/Tqdzy/nF1EMpZ3QC1RAPzlPAG3z2zB/wgNra2pUrV2q12iVLlpSUlFRWVoaGhj558uTixYtWq3XhwoUEQaxdu3bt2rUEQXCl0wkODuaqC+1SKBSbN2+22Wx1dXXr16/3WLlYLE5JSaH/8PhAd0uYMgYGBoxGY1ZW1tDQkPdSqdK8VMUzxL6CLpWqzm63S6XSGb4GxdPJU9BvAB6XVshut+/atUsul8fHx5eXlzudTmT8jx49mpiYGBERkZeXR/cz5nA43nzzTZlMtmTJkoMHD1L5Kysr5XJ5TEzMqVOn2CnYisjv/mgwcrJB2aqrq5VKZURExNatW5HHTK7D+RsllUo3bdpktVqLi4uRs7WCggJ0h8FVkc1mo7q0oaFB+P8jrVa7adOmurq6tLQ0SptYLKYcg9IHAptO7wGBu7q6upYsWcKjinFIU1OTy4aQJGk2m9etWyeVSpOTk2tra9FffkbP8JfAc7PS29vL2EVfOmOABPf29kqlUuTY1Gq1RkREXL16VXhz6uvrN23axF8FD4wM9NLa29szMzNlMllsbOyGDRuQYwin01lSUqJUKqVSaW5urtVq5TpxqB4QMhW9kUpVRw8VSE1vxmnV3t6ekZEhkUjkcnlubq7ZbBZ4TiHY1w0hyhl5KOVc5yP/eYrVAHiJaxvz5ptvqtVqk8mk1+tXrlx5/PhxtL6/detWi8ViNBozMzP37t1L5S8rK9uyZUtvb29PT09WVtaJEyeo/IODg01NTQaDgZ2CrYj87lkCI6ecBcqWm5trMpnu3LmTmppaXl7OdThPo/Lz881mM2qUXC4vKChAbczKykKLWlwVkSRpMBjQkhRlsYQMwMjIiFwuj4iIaGtroxJzcnLUanVrayvDonClk27aGJdrPoxDYmJi1qxZ09nZyd8WjUZD9cyKFSuoKug9w18Cj405f/78smXLqF12uz0oKIjy203R3t6+Zs0a6inOoUOHVq9eTZLk3r178/Ly3GpOdnb2uXPnuPbyFMLQwC5NqVSeOnVqZGSkt7e3trYWeWCqrKxMS0vr7u42m82FhYUtLS3YE4duY4RMRW+k0qtjTG/2aVVfX//pp5/abLbBwUGtVqvRaASeUwj2dYNfOVY8vZO5zkee8xSrAfASFzbG6XTKZDLKC1ljY2NGRgaaOmNjYyixtbU1OTmZOkQul1NXQJ1Ol56ezvacz07BVoTNSeI8hqFs6Et7kiQvXLiAbguwh/M0ymX4AK6KSC/Webds2cK4qxgbGyspKUlJSRGLxS+88AJ1V8eVTgmj213q8bL3NgYbjoEBchZH7xmupyzC66U29+3bJxKJGhsb6ZkrKyvFYjH1/gI2PAQ25gK2OSaTKTExkd5krkAVPIVgNTBKw0aXIHGxJLAnDsPGuJyK3kjlmtLY04oOiuUh8JxCsK8bXMq5xDOGjEc813mK1QB4iQsbw/CWbzQa0dTh8uwyMjJCv9JFRUUplUrsNY6Rgq0ImxNLX1+fRCKhNnt6epRKJdfh7jaKvslVEempjenu7o6IiEhNTa2vr2fvdTgcbW1tGRkZBw4c4E9Ha0d0u4s92bCtY4PVzwjHwMBisTB6xoc2ZmRkpLq6OjU1ldqFLiiXLl2irlnY8BAkd8wFRnOcTqfFYqH2MgJVcCEkRAW7NHZ0CWwsCf4TR+BU9EaqwEszgh3LQ+A5RXJcN7iUc4lndLK7NoZfA+AxPv4+xuFwiESizs5OnU6n0+m6u7t1Op1vqyC4vesHIoWFhUVFRSdOnDhw4MCDBw8Ye4ODg1etWnX8+PG//vWvLtNFIhHdUyc2zjRiZGQkPDzcLZ3scAxTSWRkZG5ubh/tJWyr1To5Obl+/fqQkBCUwhUeAhtzgd2c+fPnL168mMrACFSBRXiICkZpXNElsLEkfILHUoXDE8vDJTzXDezEExJbxF2m5to1B3FhY5RKZVBQ0N27d9GmwWCgvivEsnjxYqlUOjIyQl3p6OetryrSsSAIwuFw3Lt3D2UwGo1LlizxVaMYCK/IJX/72996e3uLi4t/8pOfZGZmHjx4EKU/evSIUaPT6eRJd5f29vbU1FTh+d966y2VShUTE2M0GktLS7F5lEolQRD0nvFAGA8iEXOuMlJKS0uNRqNSqVSpVJSHhdHR0eLi4j/96U/19fW3bt1CiS6bMzExcenSJf4LFrYQrAZsaT/84Q+3bdtWWlr66aefXrx4ceHChVFRUe5+nS5wKnopVQjffvutxWL5/e9///zzz8fFxaH45cLhum5wjRRbvMfKXWoAvMXlnc7OnTtzcnIYj8d5boH37NmTkZGh1+stFkt1dXVFRYWQtTJsRVw52VDPP81ms16vV6lU1DN/7OHuNoq+VoatiPzuvS+0amwymejrGFgeP36cmJhIPaI0Go1SqbS7u9tgMCiVypMnT1osFpvN1tLSkpqaWllZyZVO71KX38dYrVYh38fcuXOH3vz8/Py+76Ly8ICe+VM9Q5VA7xl+GP1Gl8HzOgCDvr6+/Px89Hvv3r3oRaNDhw5lZWXxN4d6RoL6ll8qf5/QNTBK6+npefXVV69evWq1Wk0m086dO9VqNUmSlZWV6enp6Jk/+ufucq1MyFT0Rqpba2VKpbKurs5msxmNRo1G49ZaGYm7brhUThfPHjJ6J9CV0NPHxsbEYrHBYEBnClYD4CWev7tMZWDMFYfDodVq4+PjpVJpdnZ2b2+vQBvD8+6yS5EoW1VVFfbdZe8bRbcx2IoQ5eXlUqm0oaHB4XBIJBL+q2pFRQXjoaJWq0XXwcuXL2dlZYWHh0ul0hUrVpw8eRJl4Eonv7viMMB+5798+XLGd/5sPvvssxUrVvDnYUN/d/no0aP0DqR6hr8ERr/RZQwNDYlEImoJHsUr4i/NrZgL9AnADlThDYzSsNElSFwsCZc2RshU9EaqWzaGHcvDLRvDvm54oxxBdQJDCb1zSkpKqN9eagCwzJLv/N16j2tqKiosLBTy0HgGgi7HXJ8iCcTlawVcUP3GlpGTkyORSM6dO1dSUhIUFORDM8AgJSWF7llnRpVG4Y857yepU0DgKp/1+Cx+zPTS39+fmpr68OHDmVPRs2fPdDrdj370I39L8gf//ve/X375ZW9K6O/vV6lU7LcYXELvN7aMBw8eSCSS8fFxsVgcGhrqjcJAZ8rmPAB4A/iS8RcLFiwIUANDEISXBsYb6P3GloFelqPeJQMAYIbjF9/+EL8B8BUQhgcAAhrf25hpid+QkJAwNYsGU1ZRoJOQkODBQhkbCMPDBUxFICDwvY3x8ksoOv39/WFhYT4pCggURkdHDx8+jH4PDw93d3drtVpq77vvvms2m69fv06lXLlyZeHChcPDw1TKyy+//Lvf/Y4giIcPH77zzjsJCQkhISFLly796KOPJiYmeNIJgujv75/H4pNPPmHsWrBgwQ9+8IO//OUvdOVsbVqtFnkZ4IKa4f39/TzfzLJ7hsGDBw/eeOON6OjouLi4995779mzZ/xFAcDU4fO3CHwSJINCSLQMYDbhgUueORiGh4FGo8nLyzObzT09PRkZGdSHMgAw7fjYxlgsloiIiPHxcd8WC8wdPLAxBoNBKpX29vY6nc6UlBT0rcPjx4/FYjHbHxdXussa2bvq6+uzs7MFtgWL2WxeuXIl+uHSAyNXaQ6Hg96i1tbW5cuX8xcFAFOG67WyK1euCM/Q2Ni4bt26BQsWEATR0dGxatWqkJAQhUKxcePG+/fvu1sgfSUhLCyspqYmKSkpNDR08+bNw8PD+/fvVygU0dHR27dvp5ysDAwMrF+/PiwsLCkpqaamBrv+0NHR8corr4SFhcXFxb3++uu3bt1C5R8+fFihUCxevPj06dMEQUxMTJSWli5atCg0NHTjxo301RgGd+/eDQ0N/eqrrwiCGB4ejoyMvHbtGiPPo0ePdu/erVAonnvuuQ8++GBiYoLeqMjIyF//+tejo6NU/qdPn+7YsSMsLCwhIeH999+n8tNFYmWzK6I6kJETC8p55MiRRYsWRUZGbtu27cmTJ1wl8DeKZ6S4ahkdHU1MTLTb7fPmzTtz5gz/PKFYunTprl27SkpKTp48GR4evm3bNoIgJicnCYIQi5lvTnKle0B6erperxeenz3z4+LivvzyS/SDWmS7f//+z3/+89DQ0Oeff/7jjz9Gc5inZxwOx+TkZFBQENqUSCSPHz/2uFEA4GNcWiG3gk/Q4zew40m4WyB9JYEQFohiw4YNGo1mcHCQEcKEDjt6Rx8uHgY7ngc6nB29huSIU0InIMLwUDkFRuKBMDwzJAxPWlqaVqsdHx8fGxtTq9W5ubn8VQDAlCHIl4zA4BM8ITdQPAl3C2TYGJeBKFAIE8oDBD2ECQU2ekcfLh4GO54Hgh29huSIU0IRKGF4qJxCIvFAGB53bYxvw/DQA9709PSoVKqgoCCpVEoQhA8fiAKAlwh9HiMk+AQjfgM7noS7BdJtjBDHR4zAMPQQJnTY0TvYlw9sPA9+uOKUsIXN2DA8pDuReCAMj7s2BuGrMDyMgDckSdpsttraWspaA8BMQNC7ywKDTzDeWuaJJyE8moU/4IrewQYbz4Mreg02TolnQBged5mDYXgYAW8IgpBKpceOHaMiRADATMC1jREYfIIRv4EnnoTwaBbuolQqRSJRf38/2jQYDFw5GdE72Bl44nlgo9dg45TQhQVKGB5CcFQSCMMz08LwNDQ0yOXyX/7yl8IPAQC/4/JOR2DwCXb8BnY8CbcKJN1fKyO/+/Shr69Pr9djn/ljo3dg1zTY8Ty4NJMccUroBEQYHtLNSDwQhmcaw/DY7Xa6636n05mcnNzY2OiyfACYSnz2fQw7fgM7noS7ZXpgYwYHB9VqtUwmS0xMrKqqYleKjd6BvYCy43lw6RQSpyQgwvBQOQVG4oEwPPyd6dcwPIyuPnv2LPrUBgBmFD7z7b906dKzZ8++9NJLPinNJ9y+fXv16tXglNAtpsZjvPBa3nnnHb1e/49//MOvevzB06dPly1bduDAgR07dnhcCE+IBPDtDwQEPvPtf/v2bV8V5St0Ol1ycvJ0qwC84ujRo/5432EKCA4OPnfunF+jJBQUFPivcADwCbMtfsyHH34YGxubk5PT29tbVlYG79gEOhCGh4uYmJhjx475r3wA8Al+iR8zjWRlZdXV1cXHx+fn5xcWFiK3IgAw+wgODsa+Ww8AM4pZEmsZAAAAmIHMtvsYAAAAYOYANgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF2BjAAAAAH8BNgYAAADwF/8Dmm+4Yb4AAAADSURBVJZJ8nJc7ZwAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAP8UlEQVR4nO3df0wTZx8A8LN2UGopv6v8UH7MASGEEUcIbEWdMcN0jHWIjDAmZCNgDEPXEMKAMYabIk6jXSWEsEXJ4jaCjBBiOsLY0iEjiNixyiojCLUWphUBS1cI0PePJ95777V3vQIF3Pv9/NV7eO657/Pcc3zpHX26yWw2YwAAAIADsNY7AAAAAP9akGMAAAA4CuQYAAAAjgI5BgAAgKNAjgEAAOAokGMAAAA4CuQYAAAAjgI5BgAAgKPYkWPGxsZcXV2Xd5jp6elTp04tb99VQQxgJR2xatUbtHkUJke0WWcZYY+NjW3atOmPP/4glX///fceHh72NmW1O/ZGhUIiuXDhwrJPyocffuji4nL58uVl7LtyY2Nj9o7kqgewKueFyrr/KgBrbI3ex0xNTZ08eXJtjrUxA1hdgYGBer1+vRo5d+4cqeT8+fNrdnRLPB7P9L/y8/OX1/6jR4+kUmlPT09mZuaqxPbMWcXzYtW/7EoENsG9smeVs7PzujTCZrMbGxvHx8fxkt9++02pVK7N0WmaItq8efPy2jcYDFwu98UXX0Qt/H9axfMCwHJyDOldM/Hd/Y0bNxISElxdXf39/Q8ePPjnn39iGDY9PR0UFGQwGDZt2kS6BTE7O5uXl+fj47N9+/ZPP/10cXERb//MmTNbt2718PDIysr6559/UP25ubn333/f1dU1MDDwk08+WVxcRJXPnj0bHBzs4eHxzjvvTE9PkwK2GsCFCxeCg4O9vLzeffddfBfL9klN3bhxIz4+3sXFxcfH59ChQ/fv38d/dPr0acuArXbw7bff/vzzz/Ed4+PjL1++bPPQVk8Bk+5jGHb79m0vL69ff/3VaiPM28EwjMPhJCUlyWQyvOT8+fMZGRn4ptUuk+5lYYzvvdAMOD3SEJ06dcrHx8fX1/err77CKE70o0ePSPPEsi93797dsmXLrVu3UH0PD4+ff/7ZZsz0w3v//v3ExERXV9ewsLArV66QWrt48WJiYiK+WVpampWVRTXONNcm7q233jpz5gx6/fvvvzs7O+PB5OXl5eXl2XVPbHx8/PXXX3d1dQ0ODj579ix+OKsjTPOrwOqJZj4twYa1yu9jkpKSsrOzNRpNV1eXUCjkcDgYhrm5uanVanRDg3QLoqCgQKfT9ff3y+Xy1tbWmpoaVG4wGHp7e/v6+vr6+vr7+6urq1F5ZWWl0WgcGBiQy+UKhaK2thZVHhgY6O7u7u3t1Wg0JSUlpKgsAzAYDEqlEu2i0+mKi4tp2ifq7+/Pzc2dmJhQqVQBAQH5+fl4wH1PEQO22sG0tLSWlhZUYXx8XKlUisVim4emYrP709PTKSkpVVVVCQkJK2kHV1hYWFtbi/LovXv35HL50aNH8Z9a7TJ+F6uoqCg9PZ1h1zDqAbeLwWBQq9UqlerSpUtCoRCjONFeXl6keWLZl+Dg4JKSkuPHj2MYVl5eLhKJXn31VSYx0wxvfn4+n88fHBy8du2aZY4Ri8UKheLJkydos7W1NSUlxWpsDEcjKSmpo6MDvW5ra1taWpLL5Wizo6PDsjv08vPznZychoeHOzo6Ghoa8HKrI0zzq4DmymI4LcEGZWZsdHSUx+MRX+Dl7u7uZrN5cnKSzWabTCaafYkWFhZ4PN7IyAjabG1tjYuLQ5UxDNNoNKi8ubk5JiYGvfb29jYYDOi1UqmMjY1FlWdmZlBhV1dXSEgIfQCkXbq7u/FdLNunGZDh4eFt27bRBEzVQaPRyOfzUf2amprk5GQmhyZ1AT8XVN3H64hEoqNHj9o1JjaHcffu3TKZzGw2FxUV5ebm4nOAqsuISqXasWOHXq+n6o6ZYqqQBpwUEoZh3gT5+fmWQzQ5OUnci2q0iUen6sv8/Hx4eHhFRYW3t/fExITVUEkx0wzvwsICh8MhTh40kkRxcXFNTU14eCaTiebasXptEul0Oi6Xi67T2NhYiUSSkZGBKvP5/OHhYebnBQWPh0EMnskI0w+amfG0BBsZexXTlYeHR2pqalxc3L59+/z8/GJiYvbs2UNT/8GDB/Pz88HBwWgzPDwcTSkMwzgczvbt2/FyjUaDYdjjx4/1en1QUBAqX1paYrPZGIbxeDz83X1AQMDk5KTNUIm7+Pn5oV2o2ie6detWUVHR4ODg/Pz80tLS0tISTcBUHXRxcRGJRC0tLR988EFzc3N2djaTQzPpi2X3S0tL5XJ5fX39CtshKSwslEgkhw8frq+v7+7uxstpzimGYbm5uVKp1MvLi1HHMAyjHnAiLpdLfCDE5XItu0a8ZcRwtKn68txzz8lksv3790ul0q1btzKMmWp4Hzx4gGEYcfJYNigWi9va2g4ePNjW1iYSiZydncfHx2nGmZ6vr29oaGh3d3dERIROpysvLw8NDV1cXOzo6Ni/fz/ziYeCX1paIoaBXixjPlOd6GVc3WBDsWM+zc/P25wo33777c2bN1UqlU6nk0gkL7/88pdffrmyCP/LZDKxWKy+vj48DBaLNT8/79D2SXXEYnFOTk5tbS2Hw9FqtQcOHFjesdLS0mQyWWZmZm9vb3Nzs8FgsHnoZTAajc3Nzd99911+fn5KSoqbm9vK20TeeOONoqKitLS0uLi4sLCwsbExm7tcvHgxJCTkzTfftOtATAacxWL5+/szb5PJiaY3MTHBYrEmJiaWHbNdUlJS0C2+tra27OzsFbaGYZhIJOro6BgZGUlKSnJzc4uOjlYoFB0dHSKRaOWNY8sa4VUfNLBB2HFpDQ4OhoSEYBjm6elpNBrxG8RarZZY7aWXXsrKyvroo4++/vpr/KmDVQKBwMnJ6e7du2hTrVbjf/iYTKZ79+6h10NDQzt27MAwzNfXl8vlTk5O+j/l6+vLPH6bbLb/8OFDnU738ccfP//88/7+/uhpE03ANB0UiURKpbKhoWH//v2urq4O6hqLxWpubj506FBsbGxZWdnKGySSSCRyuVwikRALqbp8//59mUwmlUrtOgTNgK8Ew9Gm6sv09HRhYeGVK1dqa2vRf7WsJGaBQIBhGHHyWNZ54YUXBALBTz/91NPTg9IAVWz01yYOPZJpbW1NTk7GMEwsFre0tPzyyy/25hiBQMBisfC/MNRqNXph73x20IkGGwL9rbT29vb6+nq9Xt/b2xseHl5bW4vKY2Njc3JyJiYmhoaGhEIhugk7ODh44MCBzs5OvV6v0WhycnKSkpJQfYPBwGazh4aGSO3n5OQkJydrNBqVSrVr1y6pVGp+ehM2NTVVq9WqVKro6OiKigpU/8iRI3Fxceh9UnV1dWVlJZMb0KQAaHaxbJ/UjkAgqKmpmZqaGhoaEovFaEeagK12EMnIyODz+Y2NjQwPPTMzw2az1Wr1wsKCzWdjpB+p1WoOhzMwMEBskOZuO9UwEquZTKbOzk7L+la7nJKS0tTUhD/5JzVF7BrxNdWAU4VktdxqBarRJlW22pejR4+mpaWZzebPPvts7969loe2jJl+eMViMXHyWB358vLyqKgo/IKiis1McW1aDVIgEKBzodVq+Xx+dHS0mfF5waWmporF4tHRUZVKFRUVZfNSovpVQHVlMZmWYCOzkWN6enqEQiGPx9u5c+e5c+fw8uHh4X379vF4vIiICKlUik78/Px8RUVFaGiok5OTQCDIzMwkPhGtqKjgcrmXLl0itm8wGHJzc729vQMCAioqKtD0RROrqqpKIBC4u7sfPnzYaDSi+iaT6fjx4wEBAVwuVyQSjYyMMJ+FeAA0u1i2T2pEoVDExMRwOJxt27ZJJBLilVBdXW0ZsNUOIi0tLTwej6Zrll0oLi4mdYFhjjGbzQUFBbt37ya2tsIcQyrH61vtsuVfNqSm8K6RXlsdcIYh0eQYqtEmVbbsS19fH4/HQ4/oTSZTUFBQQ0MDqXHLmOmHV6vVvvbaazweLzQ09IsvvrA68uiBE/HyoZpaVq9NSxkZGampqfhmTExMSUmJ5QhQnRfcxMREUlISj8cLCgqqqqpicilZ/VVAc2VRjRt4JmwyW1z/625sbCwyMhJ/vw8AmJ2d9fb21ul067vSDL07d+7s3r3777//Xu9AwAYCn/MH4BnQ3t4uFAo3coLBMEypVKJHtgDgVvN/lwEAjjA9PS2Tyez67OqaOXHihJ+fX3Jy8sjISElJSXl5+XpHBDYWeB8DwEaHP+db70Cs2Lt3b01NTUBAQGZmZkFBAVrnBgCcjRzz448/urm5PXr0CC955ZVXSktLMQx78uTJsWPHAgMDXVxcwsLCTp8+jZYkoipnLjAwkOHDGMs1r4gLNBFXfd+8eXNwcPCJEyfsDQaAdTc3N3f16tWNuVRlQkLCzZs35+bm/vrrr2PHjq13OGDDsZFjEhMThUJhZWUl2vzhhx9GR0fRkkHvvfeeRqNpb2/XaDQ1NTVyuby/v5+mfF3gq74bDIaWlpa2tjZYVxwAANaM7f8ru3Pnzq5du9BKUxERESUlJWhdYT6fr9frSR8dpyp3EMv/QBsbG4uOjn78+LHVn16/fj03N/f27dtrEBsAAADbz2PCwsJyc3OLi4vr6ur4fD6634pWE7JcWoaqnIhm6X57l/q3F4fDWVhYWN6+AAAA7MXomX95eXlnZ2dJSQm+FsiWLVtEIlF6evr169dnZ2fxmlTlJFRL99u71L9dHj58WFZWJhaLl7EvAACA5WD4Wc309PQdO3YQS2ZmZoqLi0NDQ9ls9s6dO/FPGlOV4+xdCZ9mqX/Lj3CTPuiOPV313dPTk8PhHDlyxOpXDwAAAHAERjlmYGDA3d09MjISX6+MyGQydXd3x8XFlZWVMSkfHR3lcDj45uDgoEAgMJvNOp3OyckJLx8aGsK/Q8JqfTODHMPlcrVarVar1el0pFQHAADA0RjdKysoKJBIJDKZrKysDD1OJ3J2do6Pj5dKpY2NjUzKVxH6qiXivyOj72PHN9Gq72jZ1//nb2gHAIB1YTvHXL16dWRkpLCwcM+ePUKhEP8cL+lxC/puPppyUqFdK+FbrY9hmI+Pj6enZ09PD96yQqGIioqy2SkAAABrgf5tjtFoDAoK+uabb9Dm0NAQl8sdGBhQq9UCgaCurk6n001NTSkUisjIyJMnT1KVE9u0dyV8mvpms1kmk4WGhioUCr1e39TU5Onp2dXVhR/I5re6AgAAcBwbOaayspL0xfLHjx9H35lx7dq1vXv38vl8LpcbFRVVV1eHKlCV42iW7rd3qX/k3LlzQUFBTk5OkZGRzc3NpAMtZ1QAAACshnVY29/epfthqX8AAHhGwZqYAAAAHAVyDAAAAEeBHAMAAMBRNuJ3LQMAAPh3gPcxAAAAHAVyDAAAAEeBHAMAAMBRIMcAAABwFMgxAAAAHAVyDAAAAEeBHAMAAMBRIMcAAABwFMgxAAAAHAVyDAAAAEeBHAMAAMBRIMcAAABwFMgxAAAAHAVyDAAAAEeBHAMAAMBR/gMhfbpVe/SvqwAAAABJRU5ErkJggg==)

Screenshot: rosi.it  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 5 October, 2020 11:54 GMT
Vulnerability Verified: 5 October, 2020 12:02 GMT
Website Operator Notified: 5 October, 2020 12:02 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 5 October, 2020 12:02 GMT
Vulnerability Fixed: 6 October, 2020 05:56 GMT