shmoop.com Cross Site Scripting vulnerability OBB-2060589

2021-06-2106:48:00

raviakp1004

www.openbugbounty.org

JSON

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	shmoop.com
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	raviakp1004
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAASXElEQVR4nO2dfUxT1xvHDy9CKYgFClRFxa0yrcIMMiUMMSPIcEFgDHwhVdH5AobpwoAhvsws0W0GGTLHOmTObEiYM+ocMkYIQWRGHZK6IWIpVXkToSKiYq0X+vvj5ndz095zSitFGc/nr9unp+c+53vO7dPe2/utlU6nQwAAAABgAaxfdgIAAADAfxaoMQAAAIClgBoDAAAAWAqoMQAAAIClgBoDAAAAWAqoMQAAAIClgBoDAAAAWAqoMQAAAIClGNs1ZsuWLevWrRt+HBhZQGfzGG+6jbfxAmysxu59/k+fPhWJRGfPnl2yZMlw4sDIAjqbx3jTbbyNF9DD+PeYWbNm/fbbb5xPtbS0WFlZPXv2bJjxkeXEiRMeHh6GCxcXH2UIuv03GL7OZq+H3bt3r1692qzszGTHjh2enp4PHz60XD4vvj459TRpve3bt8/q/+AGO1KM5vFIHhenbufPn7eysnJwcHjrrbf+/PPPUUhyvDGGz5UdPXp0w4YNw48DI8t/Uucvvvji3r17kyZNstwuXgXddu7cSVHU7du3R2FfozleM8a1ZMkSiqJ6e3vT0tLi4uI6Ojoslt04ZVg1RqFQ+Pr6Tpw4cfXq1U+fPkUIXb582crKSiwWI4R4PJ6VlZWvry8hjhCaNWvWt99+S/cTHx//6NEjOv7vv/++/fbbDg4OEydO/OCDD+7fv8/s9+HDhzNnzly6dKlhSs3NzRcvXkxMTCTHP/3002+++QYhNHfu3E2bNiGEtmzZ8uuvv5oaJ4hDyN9Qt2vXri1ZsmTBggVz5sw5fvz4pEmT0tPT6cb37t2Lj493cXHx9PT86KOPnj9/To7j9MTx6NGj9evXu7u7u7m5ffjhh3Q+uP4JeeL059SBsB58fX1/+eUXejs9PX39+vX0dktLy+LFix0dHZcuXdrf388EbWxsbty4QT/8/fff3dzcyF+M/v777wULFjg6Oi5fvvyzzz5jvn/g9nvo0CHmIzC7H858EEIdHR3R0dEuLi6TJ0/evn07My+E9WCoG05n3HgJeiKu9Ybw68fGxsbW1tZQN1x7Tj2NzovhOklPT09OTo6Pj3d0dJw7d+6FCxfM0xM3j5zjIutmY2Pj4OCwcuVKLy+vK1eu0MG7d+++++67jo6OixYtOnjw4OLFi8n7xeXPOV5T1/OzZ898fX137txJP4yOjo6Pj8c1ftUYVo2pra0tLy+vq6urq6vLy8tDCC1atEij0TQ2NiKE+vr6NBpNfX09IU5TWVlZUVEhl8sVCkV2djYdTEtLk0gk3d3dCoXCy8vr1KlT7F1TFEVRlGFKR48eDQ8Pnzx5MjkuFouVSuXg4CCfz6ezUigUPj4+psYJ4hDyN9QNIaRSqcrLy0UikVwur6ioyM/Pp+Nbt24dGhpSKBQXL16sqak5cOAAOY7TE0dWVpZKpaqvr//nn39aW1szMjLI/ePyxOnPqQN5PXCybds2kUh0+/bt3Nzc6upqOvj666+/9957MpmMfnjs2DGpVGpvb0/oZ+3atQEBAe3t7QcOHKioqCDvFCG0fft2iqLkcvlw8kEIJSUl2draKhSKmpqaqqqq3Nxcgg4Mhrpx6owbL1lPzvVGWD+c4Npz6ml0XjiP07Kysm3btnV2dkZERKxdu/ZF9Bwmw1mH58+fV6lUzMGekZGh1WoVCkVJSUlpaanRXeDy5xwvQbeZM2e6s1i+fDlCyN7evri4OC8v7+rVqz///HN9fX1BQYEZOrwcdMYQi8XFxcX0dmZm5qpVq5inlEolQkij0ei9hDMuFotLSkro7ZycnPDwcHo7JiZm7dq1SqWSoiijydBQFDVlypRTp04ZjVdVVUVGRjY2NsbGxs6ePVun002fPv3x48emxgnJ4PLn1E0ul8+fP1+n023cuFEmk9Hlk24jFApra2sN9cHFcXri8PPzY9p3dnZevHiR0D8hT06dCTroMOth3rx5TD5paWmJiYmG+aSmpjLrraKiQiAQDAwMdHd329nZyeVyOp6QkCBkceDAAZ1Op9FoEEKNjY10m4yMDKYf3H5pGhoa9A4KXD5CobCmpobRLSIiwqgOhroRdMaNF6cn7jjFrR+dTtfe3o4Q6uvrw42XaU/Qk5An5zpJS0tbsWIFk4CTkxOdgKl6EuaRc1w43XQ6XW1trbOzM4/HoxcPjUQiYR9fwcHB5P3i8seNF6dbd3d3F4ve3l4mpby8PD8/P6FQWFVVpRs7cHxZNoTP59MbPB6P81vFMOHxeEyHAwMD9HZubm5WVlZoaKharQ4JCZHJZDNmzCD3U15eTlFUZGSk0biPj49SqWxsbJRIJL29vS0tLUNDQ46OjqbGCckQ8jdJN41Gw6kPLo4weuIYGBhg2k+ePJn5aEnoHwen/mbMIyd6+TDxpUuXikSi4uLi/v5+Pz+/N998k47n5+fT74A0Tk5OzLa1tbXexgjmo9FooqKi6NMyGo1m/vz5dJygA27dcoIbLwHO9Wbq/BLac+pJyBM3XibPqVOnMud4zdBzpKAoisfj9fb22tjYMEGtVss57zhw+SPMeHG6ubu743axefPmPXv2+Pj4vPPOO6aN8KUyqtf8mfcC9vvdjBkzjh8/fufOna6uLj6fv2fPHqP9FBYWSqXSCRMmGI1PnTq1q6uLrhkSiaS0tJQ+J2tqnOH+/ftPnjxhR8zInxMej8fWh/1+wRlHGD1xefL5fKZ9W1vb+fPnjfaPg1N/U3Wws7PTarX0tlartbOzY/Jh3tf03hBTUlKKiopOnjzJvoY8adIkTxb0BwJ7e/vXXnvtp59+Qgg9ePCgpqbG6H5x4PLh8XhFRUUNDQ0NDQ1KpfLs2bNGdcCtWxyc4zUVU+eXsz1BT0KeJo3XVD1NnUcCQqEwKiqKXWDo/jnnnbBuOfMnwKkb57kymoyMjKCgILVa/cMPP5g71pfAC9UYgUCAEKqrq3v27BlzjYsQLy4uvnv3bktLy7FjxwIDA+lgdHT0V1999eDBA61Wq9Vq2dfrHj58OG3aNL2i3dPTU1ZWtnHjRr1kcHEvL6/KykqJRDJ79uyysjKmZpgaRwi1tbV5eXnNmzeP3T8hf5MICQnJycnp6emh9QkJCSHHEUZPXJ4hISH5+fltbW0dHR0bNmw4c+aM0f45welM0IFzPQQEBJSUlND7LSsrCwgIYOK5ubk9PT3Xr1/Xu46SmJjY1NTU1NSUkJBgRE2EZDLZ0aNHHRwcwsPD2R8qcfsdHBwcHBykP/7T2+R8AgMDT548aWtrOzQ0VFBQUFlZSdYBpxsB3HhxxxcnhPl1dXW1tbWtr69njxfXHqcnLk9Tx2uqnrh5xI2LoNvcuXOPHDmil4+/v79MJuvo6Lh16xZzsBD2i8ufAKduV65caWBB13WE0Llz54qKigoLCwsLC1NTU5ubm41r+opg9GyaWCw+c+YMvb137964uDj2s59//rmzszNCKCYmhhwXi8X79++XSCROTk6xsbH9/f10/NKlSwsXLuTxeM7OzhEREe3t7UwnfX193t7eYWFh7J6zs7MDAwMN88TFY2NjbW1tNRoNPevMKVdT4zqdTq1We3l5hYSEsPvH5c+pG+H8e1dXV1xcnEAgEIlEKSkpzFljXBynJy7P/v7+xMREoVDo6uq6YcOGgYEBQv+EPHE6E+ZRx7Ue1Gp1bGyss7OzUChMSUlhzrYrFIqgoCA+nx8aGpqVlcW+/kfPjlQqNdw7Dvrcd2pqKnPeHLff4OBgvUOjqamJkE97e3tUVJRAIBAIBKtWrVKr1WQdOHUjX/cijJfz+OI8TnHrhyYvL08oFLLHS25vqCcuT9w6MbwGRmOqnrh5xI0Lp5tOp8vJyREIBCqVit1DZ2dnWFgYn88PCAjYtWsXcz0Gt19c/rjx4nTjpKury8PDo6ioiH64bdu2gIAArVZr9IWvAsZrzEjBPgZeBIlEUlBQMPz4f5WR0tNUXqLOAwMDzs7O1dXVw2xP/yixsbHR29tbJpNZNDejmKGbqeO1NDg9OfP8Lx2PMpmMqTEjyKs2vxbCzBM7L5Hr16+bFAdGlpeos6l3jItEIrVaLRKJEhISTDpJZQnM0O0VcaxgwOnJmSccj0Z51ebXQoxhvzJgZLlx40ZmZmZSUtKyZcsIzQ4ePNjU1LR//37CD2AAAABoxrCXDDCC/PXXXyEhIQEBAUFBQeSWK1asQAgFBwe3tbWNSmoAAIxhjNeYJ0+eWFlZXb58+fvvv58zZ84o5ETT09OzevVqNzc3Nze3TZs2Md4YI8WaNWt27Ngxsn2OvoejSeC8KZ8/fy6VSnNycnbv3s1YdbW1tb3//vsuLi5Tp0795JNPmFdNmzbtyJEjERERL910CwCAVx/zv8ccPHhQz4vJkObm5h9//NG8/lNSUrRabVNTk1wuVyqVjPcJMOKcOHHCzs5uzZo17GBcXJyHh4dSqaytra2vr9e732XXrl3V1dXsH1AOZz0AADDeMF5jeDyetbU1n8/n8/nsG/1aW1vFYvGOHTs431mam5vXrFmzcOFC5n4uTm+7mzdvTpgwoaenh25z7tw5FxcX+iNzVVVVamqqu7v7tGnTysrK9u7dS86T4B353XffGXoFmtrPrVu3li1bNnHiRE9Pz+TkZOZzPc4zEQfOyxLnFWiqZyVn/2RPQLlc7u/vz07yyZMnV65cyczMdHNzmzlz5tatW8vKytgN3N3dp0+fzjZ9Iq8HAADGJ8ZrjI2NjUAgoM2gXF1dmfihQ4fq6+vVarWPjw/7naW5uXndunWBgYHe3t4qlSo5OZmOc3rbvfHGG/7+/iUlJXSb4uLiuLg42huO7Wnh4ODg5uZGzpPg/VdeXm7oFWhqP6mpqf7+/kqlsrq6uqqqKicnh47jPBMJ9+vivCw5vQLN8Kw07J/sCfj48WPmZgIaR0dHLy+vgoKCwcHBR48eFRUVsT1aaDw8PB4/fsw8xK0HAADGNS/+8+fbt2/HxMQw9zRNnz79448/NjSkw3nb5efnBwQE6HS6gYEBJycnxlfOycmprq6urKyMLm+RkZHkNAjekZxegVKpNDMzc/j9sMnIyEhISDBsz/ZMxHnb4bwsCV6BJnlWErwycZ6ASUlJKSkpesGamhpvb28ejyeRSHg8XnZ2tl6DwMDAwsJCQ3H01gMAAOOZF/1d2bVr19LS0i5duhQbG0tHpFLpsWPHsrKy9H53lJubS1FUaGios7PzsmXL7ty5Q8dXrVrV0NBw8+bN0tJSDw8P5n8aaEJDQxsaGjIyMvr6+siZELz8RsSb8vTp04sWLfL09HR3dz98+PDQ0BBne6Yfd3d3to+Wi4sL85TRPGnvPPryuxmelaa2t7a2NpRl8eLFt27d6u7ujoiIcHV1TUpK0mtAUZSh16ThegAAYDxjfo25evVqdHR0eHj4woULVSoVc8V43759TU1NdnZ2fn5+ycnJTKXBedu5uLhERkYWFRWVlJRIpVKmf9qbz97e3tPT09ramnaAIGCGt+Pw+7l///6KFStSU1PlcnlDQwP7BjScZyLhXBnBy3JExmVS/wghoVBI26Eb0trampeXl5OTY2g+3d7ezj7DhlsPAACMZ8yvMZs3bw4ODlapVOnp6Q4ODuynPD09v/7666amJh6Px/wejOCZmJiYWFpaWllZyVyEQAgFBwfTXoQ3b94sLCwMCwsj52OqtyNCiKKoZywI/VAUNTQ0JBQKBQJBe3s7+2IGzjMR522H8F6WIzUuXP84T8CwsLCamhrO/3XfunVrRETEypUr9eKXL1/u7+9n30xDWA8AAIxfzD7LNkxHNqYZwTORoiiRSBQUFMR+YVdXV0xMDO3Nl5aWZvQfzAjekZxegezvTAghJycncj+HDx+eMmUKn8+PjY398ssvmesuZA9HQ3BeljjvPFM9KwlemTq8h2lYWFhcXJyeyPSl/tbWVr2U1Gq1n5+f3tWsseLQBwDAaAJeMqPNrFmzsrOzo6OjX6n+Hzx4EBUV1dnZeerUKfLfYZ0+fXrz5s0xMTEymUzvLzcAAAD0GHuemIAlcHFxuXDhwh9//GH0/28EAkF5efmCBQtGJzEAAMY08D0GAAAAsBTgiQkAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYiv8BpAh04zTuLvwAAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAASXElEQVR4nO2dfUxT1xvHDy9CKYgFClRFxa0yrcIMMiUMMSPIcEFgDHwhVdH5AobpwoAhvsws0W0GGTLHOmTObEiYM+ocMkYIQWRGHZK6IWIpVXkToSKiYq0X+vvj5ndz095zSitFGc/nr9unp+c+53vO7dPe2/utlU6nQwAAAABgAaxfdgIAAADAfxaoMQAAAIClgBoDAAAAWAqoMQAAAIClgBoDAAAAWAqoMQAAAIClgBoDAAAAWAqoMQAAAIClGNs1ZsuWLevWrRt+HBhZQGfzGG+6jbfxAmysxu59/k+fPhWJRGfPnl2yZMlw4sDIAjqbx3jTbbyNF9DD+PeYWbNm/fbbb5xPtbS0WFlZPXv2bJjxkeXEiRMeHh6GCxcXH2UIuv03GL7OZq+H3bt3r1692qzszGTHjh2enp4PHz60XD4vvj459TRpve3bt8/q/+AGO1KM5vFIHhenbufPn7eysnJwcHjrrbf+/PPPUUhyvDGGz5UdPXp0w4YNw48DI8t/Uucvvvji3r17kyZNstwuXgXddu7cSVHU7du3R2FfozleM8a1ZMkSiqJ6e3vT0tLi4uI6Ojoslt04ZVg1RqFQ+Pr6Tpw4cfXq1U+fPkUIXb582crKSiwWI4R4PJ6VlZWvry8hjhCaNWvWt99+S/cTHx//6NEjOv7vv/++/fbbDg4OEydO/OCDD+7fv8/s9+HDhzNnzly6dKlhSs3NzRcvXkxMTCTHP/3002+++QYhNHfu3E2bNiGEtmzZ8uuvv5oaJ4hDyN9Qt2vXri1ZsmTBggVz5sw5fvz4pEmT0tPT6cb37t2Lj493cXHx9PT86KOPnj9/To7j9MTx6NGj9evXu7u7u7m5ffjhh3Q+uP4JeeL059SBsB58fX1/+eUXejs9PX39+vX0dktLy+LFix0dHZcuXdrf388EbWxsbty4QT/8/fff3dzcyF+M/v777wULFjg6Oi5fvvyzzz5jvn/g9nvo0CHmIzC7H858EEIdHR3R0dEuLi6TJ0/evn07My+E9WCoG05n3HgJeiKu9Ybw68fGxsbW1tZQN1x7Tj2NzovhOklPT09OTo6Pj3d0dJw7d+6FCxfM0xM3j5zjIutmY2Pj4OCwcuVKLy+vK1eu0MG7d+++++67jo6OixYtOnjw4OLFi8n7xeXPOV5T1/OzZ898fX137txJP4yOjo6Pj8c1ftUYVo2pra0tLy+vq6urq6vLy8tDCC1atEij0TQ2NiKE+vr6NBpNfX09IU5TWVlZUVEhl8sVCkV2djYdTEtLk0gk3d3dCoXCy8vr1KlT7F1TFEVRlGFKR48eDQ8Pnzx5MjkuFouVSuXg4CCfz6ezUigUPj4+psYJ4hDyN9QNIaRSqcrLy0UikVwur6ioyM/Pp+Nbt24dGhpSKBQXL16sqak5cOAAOY7TE0dWVpZKpaqvr//nn39aW1szMjLI/ePyxOnPqQN5PXCybds2kUh0+/bt3Nzc6upqOvj666+/9957MpmMfnjs2DGpVGpvb0/oZ+3atQEBAe3t7QcOHKioqCDvFCG0fft2iqLkcvlw8kEIJSUl2draKhSKmpqaqqqq3Nxcgg4Mhrpx6owbL1lPzvVGWD+c4Npz6ml0XjiP07Kysm3btnV2dkZERKxdu/ZF9Bwmw1mH58+fV6lUzMGekZGh1WoVCkVJSUlpaanRXeDy5xwvQbeZM2e6s1i+fDlCyN7evri4OC8v7+rVqz///HN9fX1BQYEZOrwcdMYQi8XFxcX0dmZm5qpVq5inlEolQkij0ei9hDMuFotLSkro7ZycnPDwcHo7JiZm7dq1SqWSoiijydBQFDVlypRTp04ZjVdVVUVGRjY2NsbGxs6ePVun002fPv3x48emxgnJ4PLn1E0ul8+fP1+n023cuFEmk9Hlk24jFApra2sN9cHFcXri8PPzY9p3dnZevHiR0D8hT06dCTroMOth3rx5TD5paWmJiYmG+aSmpjLrraKiQiAQDAwMdHd329nZyeVyOp6QkCBkceDAAZ1Op9FoEEKNjY10m4yMDKYf3H5pGhoa9A4KXD5CobCmpobRLSIiwqgOhroRdMaNF6cn7jjFrR+dTtfe3o4Q6uvrw42XaU/Qk5An5zpJS0tbsWIFk4CTkxOdgKl6EuaRc1w43XQ6XW1trbOzM4/HoxcPjUQiYR9fwcHB5P3i8seNF6dbd3d3F4ve3l4mpby8PD8/P6FQWFVVpRs7cHxZNoTP59MbPB6P81vFMOHxeEyHAwMD9HZubm5WVlZoaKharQ4JCZHJZDNmzCD3U15eTlFUZGSk0biPj49SqWxsbJRIJL29vS0tLUNDQ46OjqbGCckQ8jdJN41Gw6kPLo4weuIYGBhg2k+ePJn5aEnoHwen/mbMIyd6+TDxpUuXikSi4uLi/v5+Pz+/N998k47n5+fT74A0Tk5OzLa1tbXexgjmo9FooqKi6NMyGo1m/vz5dJygA27dcoIbLwHO9Wbq/BLac+pJyBM3XibPqVOnMud4zdBzpKAoisfj9fb22tjYMEGtVss57zhw+SPMeHG6ubu743axefPmPXv2+Pj4vPPOO6aN8KUyqtf8mfcC9vvdjBkzjh8/fufOna6uLj6fv2fPHqP9FBYWSqXSCRMmGI1PnTq1q6uLrhkSiaS0tJQ+J2tqnOH+/ftPnjxhR8zInxMej8fWh/1+wRlHGD1xefL5fKZ9W1vb+fPnjfaPg1N/U3Wws7PTarX0tlartbOzY/Jh3tf03hBTUlKKiopOnjzJvoY8adIkTxb0BwJ7e/vXXnvtp59+Qgg9ePCgpqbG6H5x4PLh8XhFRUUNDQ0NDQ1KpfLs2bNGdcCtWxyc4zUVU+eXsz1BT0KeJo3XVD1NnUcCQqEwKiqKXWDo/jnnnbBuOfMnwKkb57kymoyMjKCgILVa/cMPP5g71pfAC9UYgUCAEKqrq3v27BlzjYsQLy4uvnv3bktLy7FjxwIDA+lgdHT0V1999eDBA61Wq9Vq2dfrHj58OG3aNL2i3dPTU1ZWtnHjRr1kcHEvL6/KykqJRDJ79uyysjKmZpgaRwi1tbV5eXnNmzeP3T8hf5MICQnJycnp6emh9QkJCSHHEUZPXJ4hISH5+fltbW0dHR0bNmw4c+aM0f45welM0IFzPQQEBJSUlND7LSsrCwgIYOK5ubk9PT3Xr1/Xu46SmJjY1NTU1NSUkJBgRE2EZDLZ0aNHHRwcwsPD2R8qcfsdHBwcHBykP/7T2+R8AgMDT548aWtrOzQ0VFBQUFlZSdYBpxsB3HhxxxcnhPl1dXW1tbWtr69njxfXHqcnLk9Tx2uqnrh5xI2LoNvcuXOPHDmil4+/v79MJuvo6Lh16xZzsBD2i8ufAKduV65caWBB13WE0Llz54qKigoLCwsLC1NTU5ubm41r+opg9GyaWCw+c+YMvb137964uDj2s59//rmzszNCKCYmhhwXi8X79++XSCROTk6xsbH9/f10/NKlSwsXLuTxeM7OzhEREe3t7UwnfX193t7eYWFh7J6zs7MDAwMN88TFY2NjbW1tNRoNPevMKVdT4zqdTq1We3l5hYSEsPvH5c+pG+H8e1dXV1xcnEAgEIlEKSkpzFljXBynJy7P/v7+xMREoVDo6uq6YcOGgYEBQv+EPHE6E+ZRx7Ue1Gp1bGyss7OzUChMSUlhzrYrFIqgoCA+nx8aGpqVlcW+/kfPjlQqNdw7Dvrcd2pqKnPeHLff4OBgvUOjqamJkE97e3tUVJRAIBAIBKtWrVKr1WQdOHUjX/cijJfz+OI8TnHrhyYvL08oFLLHS25vqCcuT9w6MbwGRmOqnrh5xI0Lp5tOp8vJyREIBCqVit1DZ2dnWFgYn88PCAjYtWsXcz0Gt19c/rjx4nTjpKury8PDo6ioiH64bdu2gIAArVZr9IWvAsZrzEjBPgZeBIlEUlBQMPz4f5WR0tNUXqLOAwMDzs7O1dXVw2xP/yixsbHR29tbJpNZNDejmKGbqeO1NDg9OfP8Lx2PMpmMqTEjyKs2vxbCzBM7L5Hr16+bFAdGlpeos6l3jItEIrVaLRKJEhISTDpJZQnM0O0VcaxgwOnJmSccj0Z51ebXQoxhvzJgZLlx40ZmZmZSUtKyZcsIzQ4ePNjU1LR//37CD2AAAABoxrCXDDCC/PXXXyEhIQEBAUFBQeSWK1asQAgFBwe3tbWNSmoAAIxhjNeYJ0+eWFlZXb58+fvvv58zZ84o5ETT09OzevVqNzc3Nze3TZs2Md4YI8WaNWt27Ngxsn2OvoejSeC8KZ8/fy6VSnNycnbv3s1YdbW1tb3//vsuLi5Tp0795JNPmFdNmzbtyJEjERERL910CwCAVx/zv8ccPHhQz4vJkObm5h9//NG8/lNSUrRabVNTk1wuVyqVjPcJMOKcOHHCzs5uzZo17GBcXJyHh4dSqaytra2vr9e732XXrl3V1dXsH1AOZz0AADDeMF5jeDyetbU1n8/n8/nsG/1aW1vFYvGOHTs431mam5vXrFmzcOFC5n4uTm+7mzdvTpgwoaenh25z7tw5FxcX+iNzVVVVamqqu7v7tGnTysrK9u7dS86T4B353XffGXoFmtrPrVu3li1bNnHiRE9Pz+TkZOZzPc4zEQfOyxLnFWiqZyVn/2RPQLlc7u/vz07yyZMnV65cyczMdHNzmzlz5tatW8vKytgN3N3dp0+fzjZ9Iq8HAADGJ8ZrjI2NjUAgoM2gXF1dmfihQ4fq6+vVarWPjw/7naW5uXndunWBgYHe3t4qlSo5OZmOc3rbvfHGG/7+/iUlJXSb4uLiuLg42huO7Wnh4ODg5uZGzpPg/VdeXm7oFWhqP6mpqf7+/kqlsrq6uqqqKicnh47jPBMJ9+vivCw5vQLN8Kw07J/sCfj48WPmZgIaR0dHLy+vgoKCwcHBR48eFRUVsT1aaDw8PB4/fsw8xK0HAADGNS/+8+fbt2/HxMQw9zRNnz79448/NjSkw3nb5efnBwQE6HS6gYEBJycnxlfOycmprq6urKyMLm+RkZHkNAjekZxegVKpNDMzc/j9sMnIyEhISDBsz/ZMxHnb4bwsCV6BJnlWErwycZ6ASUlJKSkpesGamhpvb28ejyeRSHg8XnZ2tl6DwMDAwsJCQ3H01gMAAOOZF/1d2bVr19LS0i5duhQbG0tHpFLpsWPHsrKy9H53lJubS1FUaGios7PzsmXL7ty5Q8dXrVrV0NBw8+bN0tJSDw8P5n8aaEJDQxsaGjIyMvr6+siZELz8RsSb8vTp04sWLfL09HR3dz98+PDQ0BBne6Yfd3d3to+Wi4sL85TRPGnvPPryuxmelaa2t7a2NpRl8eLFt27d6u7ujoiIcHV1TUpK0mtAUZSh16ThegAAYDxjfo25evVqdHR0eHj4woULVSoVc8V43759TU1NdnZ2fn5+ycnJTKXBedu5uLhERkYWFRWVlJRIpVKmf9qbz97e3tPT09ramnaAIGCGt+Pw+7l///6KFStSU1PlcnlDQwP7BjScZyLhXBnBy3JExmVS/wghoVBI26Eb0trampeXl5OTY2g+3d7ezj7DhlsPAACMZ8yvMZs3bw4ODlapVOnp6Q4ODuynPD09v/7666amJh6Px/wejOCZmJiYWFpaWllZyVyEQAgFBwfTXoQ3b94sLCwMCwsj52OqtyNCiKKoZywI/VAUNTQ0JBQKBQJBe3s7+2IGzjMR522H8F6WIzUuXP84T8CwsLCamhrO/3XfunVrRETEypUr9eKXL1/u7+9n30xDWA8AAIxfzD7LNkxHNqYZwTORoiiRSBQUFMR+YVdXV0xMDO3Nl5aWZvQfzAjekZxegezvTAghJycncj+HDx+eMmUKn8+PjY398ssvmesuZA9HQ3BeljjvPFM9KwlemTq8h2lYWFhcXJyeyPSl/tbWVr2U1Gq1n5+f3tWsseLQBwDAaAJeMqPNrFmzsrOzo6OjX6n+Hzx4EBUV1dnZeerUKfLfYZ0+fXrz5s0xMTEymUzvLzcAAAD0GHuemIAlcHFxuXDhwh9//GH0/28EAkF5efmCBQtGJzEAAMY08D0GAAAAsBTgiQkAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYCqgxAAAAgKWAGgMAAABYiv8BpAh04zTuLvwAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAXB0lEQVR4nO2df0xT1/vHD3CnpSi0UqQqgsOKisCIdlqZsq0RgsxfQyRIlCBzcxpkG0GnbMOFaKfEEERljXHGGSTMGXROHWOEIHPEiTHMMQakOBXUiog/h8gKfP84389NA/ec3nu9F+r2vP66PD095/lxbp/23vaNS39/PwIAAAAAGXAdbgcAAACAfy3QYwAAAAC5gB4DAAAAyAX0GAAAAEAuoMcAAAAAcgE9BgAAAJAL6DEAAACAXECPAQAAAOQCegwAAAAgF9BjAAAAALlw6h7T0tLi4uLy7Nkze+OUKVO+++47+RaVe34SEydO/PHHH/Hxrl273n77bXwcGhrq4uLi4uKiVquXL19++/ZtbF+9evXWrVuHxrfPPvts5cqVQ7MWItRdHFu3bvX19X348OFzzs85j1MxXPvWGRji/SkVEu5zZ8apewyAKS4uttlsFosFIbR27drhdudF4osvvrhz546Xl5eTzAMA/zUc95jHjx+vWbPGx8fH29v7nXfeefr0KbbfuXNnxYoVarXa19d348aN//zzD7ZPmTJl//79oaGho0ePXrFixePHjxFCLS0tbm5uf/75Jx7z/fffe3t7Uxr4r7/+6uLiotPpEEIKhcLFxSU0NJR9tLm5Gc+/cuVK1p+bN28uXbpUrVaPGzfugw8+YP0h8ddffy1cuHD06NG+vr7r16+3d6axsXGA/6R4m5qaXnrppbt37+IxZ86cUavVeCqh/lBwdXV1c3Pz9vZ+7733ampqxE1CinfKlClffvnl4Hy2tLTMnz/fw8MjKirq0aNHDufnrDtl3d9///21115zd3cfPXr08uXL7927h6h1F5rPPXv2uPwP1kjfV/znoeSNhKD8Cz1fMJz7dtOmTevXr1+xYoWHh8eMGTN+/vlnbOfczx9//PHevXsRQjNmzHj33XcRQuvWrfv2228RoV6IXBfSupLkBwncn5R8kl7HQkNDv/nmGzaWNWvW0Jeora2dNWuWh4fH4sWLt23bxn6u4syPiH1Ieb1ychz3mKysrKtXr16+fPnKlSs3btzYvHkztm/YsKGvr6+5ubmmpqa6ujo3N5d9SkVFRXl5eV1dXXNz8+7duxFCkydPjo2NNZvNeMDhw4dXrVo1cuRI0qJz5szp7u5uaGhACD148KC7u/vy5cvso+fPny8rK7t06dKlS5cKCgqw8f3332cYprm5ubq6urKyMj8/nx5XRkbGzJkzLRZLVVVVZWVlXl4e+9CFCxcG+E+Kd+rUqTNnziwpKcFjiouL4+PjcVxC/XFIb2/v8ePHQ0JCxD2dEm9ZWdngfKanp2u12mvXruXn51dVVfFZYnDdKetmZmYGBwe3t7c3Nzf7+fmVlpYiat2F5vODDz6w2Wx1dXX2Rvq+4j8PhjNvJATlX+j5guHctwihs2fPpqen37p1KyYmJjk5GRs597NOp7NYLL29vUqlEmepubk5KCgIEeqFqHXhXFeS/CCB+5OST8rrmCCSk5P1en1bW1tubm55eTlr58yPiH1IyY+z0++IsLCwkpISfHzr1q2amhp8rNFozp8/j4/z8vKio6PxsU6nY8fb28vLy1UqVVdXV3t7+4gRI+rq6hwuja8OdXd32xt1Ol1xcTE+3rJlS2JiIutPdXU1u25MTIzD+Vk2b96clJRE958Ub2FhoV6v7+/v7+rqGjVqFOuDUH/8/PzKysrw8c6dO5ctW4aPQ0JCPD09NRqNQqHQ6/WNjY3YvmrVqi1btvCPkRIvKZ9svBkZGaydBClvpHWXLVuWnJxssVhsNtuAYZx1F1ff+vr6wZucc36h85Dyxgc++Rd6vpDyn5mZmZCQgI/b2tpGjRr14MGDfsJ+rqysXLRoUUNDQ1xc3LRp0/r7+/39/Z88edJPrhepLqR1pcqP0P1JyifpvA4JCWHzmZmZmZKSQpm8u7sbIdTQ0MD6z+d1ScQ+ZOdn8+P8MA6bUFdXl0KhwMfjxo0bN24cPu7u7mbtSqWyq6uLfQqnPSoqSqvVFhcXP3r0KCws7JVXXhHdF5VKJbuQzWZj/VmyZAnDMPg4PDycPsmJEyd27tx57dq1vr6+rq6uJUuW0P0nxZuYmJiRkdHU1HTlypWxY8fOnz9fnD8UcnNzlyxZYjAYNmzYMHXqVHGTUOIl5dM+Xj5LcOaHtG5+fn5WVpbRaOzo6IiMjDSbzQEBAZTJJcynVHDmjYTQ/Is4X0jnIzv/hAkT2GtonPs5KCjIYrE0NDQEBwd3dna2tLT09fV5eHggcr0odeFcV6r8CN2fpHxSXseE4urqOuAASbdvKflxchz3GKVSibs0Qqi1tfXq1auvv/46QkihULD2rq4u+zLb29n6IYTS0tKKiop6enpSU1OlCoBFoVAcPnxYr9fjP0eMGEEZfO/evYSEhKKiosjISFdXV5PJ1N7eTvefFK9arV60aFFRUVFDQ8OqVavE+TNgfvt9jxBSqVTjxo3LyMgwmUzJyclubm70qYTGS/KHPd94nniD80ZZNyAg4OjRowihx48fp6SkZGdnf/3113R/BOXTqRCRfyT8fCGdd5xw7ucJEyZYrVa2x5w+fRrfM0DkeklSl6HZn5z5JJ3XI0aM6Onpwcc9PT30uEaOHBkYGHjkyJEdO3bcv3+/urra39+fnX9Y8uM8OL4fExkZWVhY2NraevPmzdTU1JMnT7L2vLy8u3fvtrS0HD58ODIykn1KcXHx7du3sd1gMLD2lJSUxsbGxsbGpKQkPs6pVCqE0KVLl549e+bwHq/BYDh+/DjDMH19fQcOHKioqKAMttlsfX19Go1GpVK1tbUNuBhaUlIy2H9KvCkpKadPn66oqLC/6CzIH4TQ7NmzDx48iOc/duyYfd4wa9euffDgQXFxsX0Uz+wQHS8ner0+Pz//7t27f/zxh/31ZQqD605Zd+nSpbt27bp//35PT09PTw9+o4fhrLvQfPb29vb29uK3vfiYPr+IefgjIv9I+PnCuW9JkPazn59fRUVFcHDwtGnTzp49y/YYUr2E1oWTodmfnPkk5UGv15eUlGD72bNn2SZBwmw2Hzp0yN3dPTo62v7DCiU//PehuP3jJDjuMSaTKTAwcObMmWFhYf7+/iaTCdsLCwtdXV2DgoLmzZsXGRmZmZnJPsVgMCxYsCA8PFyn07HfEUAIeXh4RERExMbG8vwOqLe3d05OTmxsrEKhSEhIoA82m82dnZ06nS44OLihocFoNFIG+/r6FhQUJCcnazQak8m0aNEi+0eNRuNg/ynxxsTEWK3WkJCQyZMni/MHIZSXl8cwTFBQUEREhNFoTEtLGzDAw8MjLS1t+/bt7Mvc7t27Ff9Do9GIjpeTgoICq9U6adKk9PR0nh/MB9edsm5WVlZpaen48eMDAwNtNltOTg77EGfdhebzjTfeYBgGn+0MwzAM09TURJlfxDz8EZF/JPx84dy3JEj7OSgoqKamZtq0acHBweXl5fiGPyLXS2hdOBma/cmZT1IeTCaTQqHQ6XQGgyEmJsbhR8moqKjbt29brdba2lp8SmI7JT/896G4/eMsSH6HR6fTnTx5kvOhrq4uT0/PqqoqyRcFhh1K3QFxwPkiLXLn02az2Wy2hoaGSZMmmc1mmVZ54XB8P0ZCjh07NnbsWHw7BwAAOnC+SIvc+dRqtR0dHVqtNikpCX4rzeLS398/3D4AAAAA/05ASwYAAACQi/9EjxkWbU06zq+xKIgffvjB29ub/fOvv/5yc3O7c+cOafyOHTtYgZYhTgK97gPq4tBPqTQ35UZoXIPhzNsw1pGCVPl3wjq+kAz3DaGhgKQXAPeopQL/IOPy5cv4z4MHD4aHh9OfYrPZrl27hhDi//NvSRBadxF+iv799lAiNC5S3oarjhSkyv8LUUfnx/HnGJLWoSBNTAok7Tmh83AiobYmSeNPEq1GRNYc5OS33357/fXXZ82aNX369KNHj3p5eW3atAk/RKqLVP5z4u7uHhERUVlZif+sqKiIjY3Fx6T6urm52f8mhoWkgSi0LkI1T0l1IfkpSHNThMYlp/8UDVZSvELjEpo30jxC95UI7d3B+4RyvpPi4lxXqGYl5XwUmgdB8b4Q8LpWxql1KEgTUxzPP4+02pqcGn+SaDUisuYgiatXr5aVlWm12rq6uvLy8sLCQmyn1EUS/0lER0ez0oRVVVUxMTHi5kEEDUShdRGqeUrRvuREkOamCI1LTv8pGqykeIXGJTRvJITuKxHau4P3CeV8J8XFua4IzUrS+Sg0D4LifTFw+ElHqEYkaXxSUpLGjtzcXGwnac/x0VjkiSTamhRtQUm0GikakYOpq6vDF6PWrl1rNpvxr9BZ/znrIq3/nC55enrabLb6+nqVSsVGQdEWbGtrQ4OusUhVF3v4aJ5iODU0Of2kjOfcbyI0YTn9J2mwksaLi2vwPJS8cc4jdF+J0N4laZI6vMZlHxdpXT7zsNDPR0F5EBGvk8Pr9zGCNCJJ4wsLC1ldIITQqFGjxK0rIUK1NUnagpJo3gnViCRBqYus/r/yyitKpfLSpUsXL140Go0iRNUG+/k8dRGqeSo3QjUuSf6TNFil0kyUKm9C95UI7V1JNElJ60qF0DxIFa/zwKvHCNKIJI338vLilMSgaM9RNP7u3bunUCiwIqy0iNCylESrUahGJMUfUl1I46XSmlywYEFVVVVNTY39C5MgbUGp/BSheToE8Ne4pPjPqcEqlWaihHkTuq9EaO/yhxIXaV2peB5tXNHxOhW87sdwalyK0MTkhKI9R5qntbXVz8+P/3/rkk9bU8R4ksYiRSNSEJS6SOI/hejo6MrKyurqavubMZT6jhkzhmGYy5cv89GalFvzlKJ9yemnCM1N/hqXdP8Ha7BSxguKS0TeSPkRuq9EaO+SGJx/SlykdTnnEYGIPAiN19lxeDVNp9OZTKbg4OBRo0bFxcU9evQI261Wa3x8vEql0mq1aWlp7FVL0ngSHR0dcXFx+N9wpaWlsdfxKfN0dHT4+flFRkbyvyaYk5Pj6emJEGL/95f9dzE///zz+Ph4fNzW1rZkyRKVSqVSqRITEzs6OrCd9H+KSONJzJs3b0AJ8L8du3DhwuzZsxUKhaenZ0xMTFtbG2USyvVfUl2k8p+C1WodMWJESEiIvZFUX0xBQQGr5onzIFVd9u3bN378eKVSGRcXt3PnTvb6tU6nKygoGLyvSHUh+UkfP3i/YeLi4latWsUnmST/+/v7bTabVquNiIjgM15oXELzRppH6L569OhRSkqKRqMZM2ZMampqV1cXtlNeZzj3CWZw/klxkdYlzcMJ5XwUmgdx8TozjrVkpkyZsnv37qVLl9KHiR4v9zwA4CQ8ffpUq9WeOnUKJMiA/w7/id/5A4AzABqXwH8Q0MQEAAAA5AI+xwAAAAByAT0GAAAAkAtePUaEbrGz6Qo/v+7s0MA/b6+++qrQH9Ds37/fy8tr+vTp9kZWH2mAnhLJzrJp06aoqCj7eVavXo1/BfXmm2/W1tYK8o0nL0odAQD4f/h8+exfqVvshHqxgtDr9YcPH+Y//sMPP4yNjd23b9+0adPs7cuWLYuLi2tvb7dYLGFhYdu3b6fbMTU1NWPGjGG/YG2z2cLDw9PS0m7cuNHZ2ZmXl6fRaBx+bV0SXvQ6AsC/GwefY0ToFkuiK4wIeqUUfVOpdGcRQg8fPnz55Zft36RTEKT7S9HNJflJ0cFl+eqrrwICAu7fv4/IetWpqalnzpzRarUDnnv+/PmMjAwfH5/JkyenpqZWV1fT7Qihp0+fpqSk5OfnT5gwAVuqq6u7u7v37t07ceJEtVr90UcfjR079sqVKwih2traWbNmeXh4LF68eNu2bStXrkRDVUdOBOn7UvwEAIAPDnqMCN1iqXSFSXqlJH1TqXRnMTabjb8iEH/dX4puLslPig4upqWlJSMjo6ioSK1WYwunXjVJnBzrI61evXrPnj0KhWKAHt1gO0Joy5YtISEhq1evZi0WiwULMf30009Tp0596623PD09nzx5ghBKTk7W6/VtbW25ubnl5eXsU4amjoMRqu9L8hMAAD44fgM4cuRIrLGjUCgGqJEnJibid7Lx8fH2Jz/nW0ulUtnT09Pe3j5p0qQ9e/Y4XPfChQulpaU+Pj4+Pj6pqanl5eX4LaRGo/Hx8dHpdDqdTq/Xs699J06cwAe+vr7Lli3DQrMUfyh4eXm1trbyH28wGLA0YUZGxoEDBx4+fOjl5UXyJyUl5dChQxs3bnz69OmpU6fOnj1L95MSF0Kot7c3KSkpPT2d1UZECCUmJmJpv5SUlLKyMj4hdHZ2dnZ2jh8/3qH93Llzx44dw59RVqxYERISsm3btp6eHixglZ2dnZaWFhERgeVknj171tjYWFpaqlar1Wp1ZGTkjRs38DxDUEdOqqurs7KyJk6ciBA6cuQIvs6G7SdPnsT7Deftk08+ofgJAAAfnut7ZYJ0QPPz8202m9Fo9PT0XLhw4fXr1+njsV4pPuezs7Pxm2IKJ06cmDNnjq+vr4+Pz759+/r6+vgH8pwM0P3F0p8kfxITE+vr65uamk6fPm2vm0uCEldaWppGo7l69Wp2drb9U0ToCh87duzTTz/lY09PTzeZTD4+PpzzWK3W6OjoWbNmBQUFsUZXV9cBBxTkruMAnd25c+fiY4reLQAAohm67y5jXeHr169brValUjngZXEwCoWiqKiovr6+vr7eYrGcOnWKMhjrqmZkZNTV1dXX169du1ZS3wVD8YfVzS0pKWF1c0XMgxDavn17XV3dmDFjBvzDKKH6uN3d3R4eHi+99FJ3d7f9+wZOe2dnZ2pqKr4vcvz48QGzeXp6WiyWx48f37p1CyE0cuTIwMDAI0eOIITu379vf1NHRLwiuHfv3t9//21vGaCze+7cOft48fG/Q+8WAJwBXj1GkP6oVLrCUunsCtXTRQg9fPhw4sSJb775Jt1Dcf4gLt1ckp/0eVQqVUBAwPHjx3fu3PnLL7+wdk69ajwn/lhgH++8efNYnddDhw6xOq8ke2trK/uNkfj4eGxkGAa/QG/YsCEuLs5gMAQHB+OHzGbzoUOH3N3do6OjHf7zDGnryKnPLaG+LwAADuHVY7y9vXNycmJjYxUKRUJCAn3wG2+8wTAMfjVhGIZhmKamJoRQVlZWaWnp+PHjAwMDbTZbTk4OfR6z2dzZ2anT6YKDgxsaGoxGI2Wwr69vQUFBcnKyRqMxmUyLFi1y6A9CyN3dPS8vLyEhYYCdHUn3UJw/CKGYmBir1RoSEjJ58mS6n/R5MKGhoXl5eYmJiexX9QwGw4IFC8LDw3U6HXtPOzw8nGGYhISExsZGhmHw+waEkNls7uvrCwoKmjdvntFoZMeT7JxMmjTp4sWLvb2969ate/DgwZUrV4qLi3HJoqKibt++bbVaa2trFQoF/XOVtHVUKpUajcbf399+CZPJFBgYOHPmzLCwMH9/f5PJhO2FhYWurq443sjIyMzMTIqfAADwBPTK/m0Ml1713LlzdTpddnZ2YGDggH+CiT9bNDc3x8bGbtmyZd26dUPsGwAAwwVoyQDScPr0aaVSaTAYGIZpaWmxf0ir1TIMYzQa4+Lihv1WGQAAQwl8jgEAAADkAj7HAAAAAHIBPQYAAACQC+gxAAAAgFxAjwEAAADkAnoMAAAAIBfQYwAAAAC5gB4DAAAAyAX0GAAAAEAuoMcAAAAAcgE9BgAAAJAL6DEAAACAXECPAQAAAOQCegwAAAAgF9BjAAAAALmAHgMAAADIBfQYAAAAQC6gxwAAAAByAT0GAAAAkAvoMQAAAIBcQI8BAAAA5AJ6DAAAACAX0GMAAAAAuYAeAwAAAMgF9BgAAABALqDHAAAAAHLxf1BgwiVk13yIAAAAAElFTkSuQmCC)

Screenshot: shmoop.com vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	21 June, 2021 06:48 GMT
Vulnerability Verified:	21 June, 2021 07:03 GMT
Website Operator Notified:	21 June, 2021 07:03 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
x. Using Twitter notification
Public Report Published [without technical details]:	21 June, 2021 07:03 GMT
Vulnerability Fixed:	17 August, 2021 05:50 GMT
—	—

JSON