Lucene search

K
openbugbountyGh05tPTOBB:976243
HistorySep 19, 2019 - 10:54 a.m.

fdp-muehlheim.de Cross Site Scripting vulnerability

2019-09-1910:54:00
Gh05tPT
www.openbugbounty.org
4

Open Bug Bounty ID: OBB-976243

Security Researcher Gh05tPT Helped patch 6892 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affectingfdp-muehlheim.de
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: fdp-muehlheim.de
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **Gh05tPT Helped patch 6892 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAWe0lEQVR4nO2df0xTVxvHr1ix1IIVS0WpWNBUbJxDowYdMwQXRxghXeYYY52iIwYJY8wwh8Q5ggSZq8uGxhCjBhfjzLIYYwxxxi2EMKcVSe0Yqw2yDmtlWLGwjlVE7/vHiScn98fpbaHA9j6fv3pOz33O83x7z316z7333GksyzIAAAAAEAYiJtsBAAAA4D8L5BgAAAAgXECOAQAAAMIF5BgAAAAgXECOAQAAAMIF5BgAAAAgXEyJHJOUlHTr1i2xIjAxTDXZp5o/wKRz69atnTt3TrYXQHBMfo755Zdfnj179uKLLwoWgYlhqsk+1fwBpgKFhYU6nW6yvQCCI0CO+eOPP6KjowW/GhwcPHDggFhROhcuXMjNzRUsfvjhh1FRUadOneK4NGfOnBA6Cgdi+pD1FA2DshkaEuUiZX/06NG2bdvi4uISEhI+/vjjJ0+eBNUdcn6MPxP256+//vrggw8WLVoUFRW1dOnSzz777OnTp7jZqVOnli1bFhUVtWzZssOHD5NuTCNYuHDhnj17cCCcXwc3mz59elJS0v79+1EX04QIOSJ+18FCkUJMB4YqhUQdmDFLEXLU5FHl4cOHNputvLw8oBr0Y9E4ji/BAxTAhaXidDqVSqWUrygt6axdu/by5cv8osfjiYiIsFqto6OjnH5VKlUIHYUDsajJ+hCU8fv94+Dc896lyEX+Crm5uQUFBS6Xy263p6enV1ZWBtUdCnaMPxP2Z/PmzUaj0W639/f3X7lyJSMjw2KxoDbHjh3TarUXL170eDwtLS1Lliypqakh3fD7/X6/f3h42GazpaWl7d27l+Mkv6XVal27di2ygyrtdrtKpfI/J+SI+F0Hi5gUFB34AZJSSNSBHbMUIUdNGUeUHSNgd+MyvsQOUACHSc4xbrdbpVKNjIzwi5TD938+x4wjUuQiZR8eHtZqtT6fD31lsViWLFkivTuXy7Vq1Sr0Ye3ataH5jP0ZHh6WyWRer1ewmVarJf+ddHR0KBQK5Dlf87a2tpSUFPSZ/uu0tbUZDAZcHN/9LeSdgSIFRQfBHrEUQenAjkGKcc8x9B1jYkbc5I7rfxGSrsd89dVXSUlJc+fOfffddwcHBxmGGRwc1Ol0Pp9v2rRpp06dIotffPFFdHT0559/Pm/evDlz5mzduvWff/4Rs3zhwoVNmzbNmDGDU3z48CFp/969e6+++mp0dPTSpUvPnDmDGqNzXokdocaHDh1KSkqaNWvWW2+99fDhw48++iguLm7u3Lnbtm37+++/Gd55NDnh8/jx4/feey86OnrRokWffvopOWPD10eKhmJm+fNsAd3mICgXJQTyV4iKirp79+6sWbPQV93d3QsWLGAY5saNGy+//HJ0dHRCQsIbb7zx22+/CYaZkJBw8+ZN9OH69euo8vvvvxf7XTBkG+zPs2fPGIaRyWT89oODgy6XKyMjA9esXLmypaVFzL5cLvf7/QHdQC1HR0clujpGAprCDcSkCFYHRrIUIetw48aNdevWRUVFxcXFvfnmm/fu3eM0ENwP0a5+4MCBuLi4+fPnnzhxgnOQIS3QdwxyK75ZcjoXD645c+a888475MC8f//+a6+9Fh0dnZSUdOjQIc7EL+cAxe+Fotv/G4FzjM/ns1qtV69etVgsbre7srKSYZjZs2fb7XZ0cm0ymcji66+/7vP5LBZLe3t7e3t7R0fHwYMHxYyLXYyZO3cuab+0tDQmJqarq6u5uZk8aErvCAfS1tZmtVrdbndKSorH47HZbNeuXXM6nVVVVXQdampq0FTDpUuXWltbGxsbKfpI0ZBudixui8kl1hfnV8Dcvn27oqLCbDYzDJOTk1NYWNjb29vW1paeni6XyxmGieMhKF1hYeHGjRtR7uFz48aNjRs3FhYW4hrsz6xZs7Kzs/Pz83/66SdONvX5fHK5HP87QaxZswZnR5LBwcHq6urs7GxBB0gePHiwd+9eo9FIaUMPJygopjiyiEkRlA6MZCnGokNHR8eOHTv6+vo6Ozu1Wm1paSmnAWUo2e32zs7Opqam9PR0zkGGtEDZMfhbccySjX0+n81mQwOzt7eXHE2lpaWRkZHd3d1Xrlz5+uuvOSFwDlD0Xv7foZ/mOJ1OhmGGhoZQ8erVq8nJyfgrwbkytElvby+qP3fu3OrVq9Hn3t5enU6HN/H5fEqlcmBgQLCIDY6OjsrlctIgOmGndCQWCD65bmtri4iIGB4exnGhGSF+UHhyQK1W4/kHNFtN0Ydzji+moaBZ/rYB3SYRk0ssBI7sGJfLlZycfPbsWZZlBwYGZDIZfxbbxYOrO8uiLurq6mJjY/Py8hwOB653OBx5eXmxsbF1dXXYMY4/Q0NDlZWVer1eJpMtWbKkuroaTX/TZyqQburnREZGFhQUCE4fkS1jY2PlcnlxcTEZKX+CSCwcKXDcFjQlKIuYFAFnbChSBKUDXwopOnR3d8fHx3OcpAwlzn5Imc0T2zEE4yLNco5UeGC2tbXhgYkGUU9PDyqSg0jMN77zACK46zHkTkbJMXK5HNd3dXVpNBr0eXR01O1246/OnTuXmZkpVsQG3W43xyDOMWIdqQkCBkIWxZoNDAyQAzU2Nhb1JdaeMjbIrgXNStyWX0SIySUWAkd2TFpaWkNDAy7m5+enpqbu2rXLbDa3tLTw2wdkYGDAaDTKZDJcI5PJjEYjZ1ZdzB+/33/16lV8vdrlcpFhcnA6nQqFAqW9pqam+Ph4nJhZ3q+DW7rdbv71W7GLEJxw+LucYKVgSuCYEpRFTAq6DnQpgtJBTAr+z9rR0fHKK68sWLAA7WYqlYrsSOJQEvRQMJtydoyAW5FHKrHB5Xa7IyMj8Vd4EAXrG8CyrMCEZviYPn36/PnzcZFy1/IYsVqt42IH4/f7IyIi2tvb8RRwRMQ4PFokaHZkZGTsliX2xYjIfv/+fZvN9vPPP+Oab7755ubNm52dnW63e9euXevXrz98+DB/cuzBgweCvd+5c2ffvn2tra01NTW4sqamxmw2l5SU1NTULF68GFWK7QYzZ85ct25dQ0ODyWTav38/mqZ48uQJOU108+bNlJQUNE0UERGRkJDAMMzWrVvNZvPx48fff/99Qd9wS+nwwxHc5aTsh3xTgrKQkFJUVFTQdWAkSzEuOjAMYzQai4qKGhsb5XK5y+XKysoiNxn3ocTZMcZiCggL9BQU2nkMQ0xhnT9/XnAKa3R0VK1W47NRTpE0yJn8OX/+vOBcmVhHAQMhi0NDQxEREeTpM26mVCo7OjokmpV+LsI3O8bzGDG5BPviy47r+ZUYq9Wq1WpZyXNlxcXFSqVy165dHo+H85XH4ykvL1cqlcXFxYL+kJNFLMu2trbiCQ2tVnvlyhX8VWdnp9h9ZWfPntVqtXjmJ6h/oHyRKeEEi5gpjiwIMSkoOrBUKYL9J86RQtD5/v5+8pzGarVyzmNYaUOJX8mfZhRUI2BcUs5j0CByOp2oKGWuDM5jxAg9x/h8PplMhudhcREd+jdv3uxyuTo7O1NTU6urq7EFPM5bW1uXL1+O6zlFTtdGo5E0SOYYsY6kB8Iprl27tqioqK+vz+FwpKen4/ri4uK0tDT0R/7gwYPo0QExs0NDQzKZzG6382fM+QOVYza0HENOnQvKJdgXX3YMabCrqysrK+vHH3/0eDy9vb1FRUU5OTliUvMxmUx4uAridDpNJhPL2w3sdrtGozl27Jjb7fZ6vejburo69C35XEhra6vBYKitrcUGOWPeYDA0Njbyvw0hxwQMhw4pLN0UloWlSkHRgaVKMcYcI+a8RqM5evSo1+t1OBxGo1GlUpHDgZU2lBDkQaa3txfPCtJ3DHKr0HIM+/z5G6fT2dnZuWLFCv5AgxwjkdBzDMuy1dXVCoWiqamJLB46dEipVNbX12s0GpVKtWXLFsH534qKiqqqKmyKU+Q0drlcmzZtUiqVer3ebDaT5wqCHQUbCFns7u7OzMxUKpUGg6GhoYHct8rLy7VarUKhyM7ORv+1KWYrKyuROPSu+WZDyDGcZoJyCfbFl12wo5GRkerqar1eHxkZqdFoTCZTX1+fmNRjge9Pc3NzRkZGTEyMQqFYsWLFsWPHyG+bmppSUlLkcrleryevHvHH/OnTp3U6Hf/RqxByzFgYy8GIIoWYDoI9YinGmGPEaG1tXb16tVwuj4+P37VrF9oEDwdW2lDC4IOM3++Xy+X4Ty19x8BbhZxj+vr6cnJylEqlTqerr6+nz09AjqEQIMeEgES59Xr9tWvXxIrj2BFAIQTZw8pU8weYUpSVlQneDxJu0GnTxPf732BCr/mT3L59m1IEJoapJvtU8weYUpjN5nG/nUcKVqs1OTl54vv9bzD56y5PZWAt8X81T548efvtt//880/BIh14s8AUZMaMGWvWrJmYvvbv33/ixIkHDx5cv369qqqquLh4Yvr97wE5hgasJf6vZsaMGZGRkRUVFYJFCvBmASAjI+Po0aNardZkMpWVlW3dunWyPfrXEu7JOHw1MiUlhX5VdnztS4F+DROtq4rv8uToRi5Y4Pf78/PzKeEINvB4PCaTSa1WL1iwoLKyEi8MisnKysK3QgnCadDT05Obm6tSqTQaTVFREechPn4IWVlZ6Cu73Z6VlRUTE6PRaLZv3y729J9gFJTYh4aG4uPj7Xa7oDVBbwNqEjBMjiYdHR3x8fFiRTFqa2tLS0txFGVlZYmJieiKen19PX4+kbJvkzprtVoyFs61YtwsIiJCp9PV1NQg+5MyWgFg3AnvXhtw9fXw2ZcCPcfw7xvBq5rX1tbm5uair/x+f0ZGxubNm8XCEWuQnZ2Nl9Ann1JGoMuMlDvl+A0MBsPu3bv7+vp6enqMRmNBQQE/HD8BPuolJycXFRW53W6Xy1VQUJCfny8xCnrstbW1FRUVYv4LekvXJGCYfE3EnuKiQ77pIIQV9Umpp9SbBQBg4glvjglq9fXxtS8F6Tmmr68P/+tnWdZgMJw7dw43q62tpYQj2MDn80VERJALken1enKrkpISwSOsWAP+s2/oMUnBcEj8fv+XX36JHzu12WycDSlRUGIfGhpavnw5NstB0NuAmgQMky9aCDmG86aDEFbU5/cyRd4sAAATT+Ac4/P5duzYoVartVotuQyf2WzW6XQKhSIvL8/j8VRUVKDVhwoLC9FI83q9DMNwpjssFgs5Dr/88kudThcbG2symfBItlgsaWlpcrlcrVajZwlx+7q6OrVaHR8ff/z4cbp9vtuoAfnsSF1dHfnsyPbt25VKZWJi4r59+yirDVosFrVazelXymMWlIMd51Di9XpjY2Mpz6AINjAYDEeOHGFZdnh4uLi4mHM64nQ6FQpFWVmZRqPRaDTl5eX8NalGRkZ27969ZcsWiVFQKuvq6vCDU4LwvaVrEjBMQU0k5phLly7hz42NjXl5eegzepqP/69Fyr5NftXe3o4nV+k5pr29ncysfBFIVwFg6hM4x2zfvj0nJ6e3t7ezs3PVqlUNDQ1oEtlkMrlcLvQwvFqtLiwsdLvdDocjIyOjrKyMlbBqIcMwaCv02CNeNqOxsfHkyZNer7evr6+8vNxoNOL2W7Zs6evru3Tpkt1up9vnu43q0TPwvb293d3dy5cvxwO4qqoqPz+/p6enq6srIyPjyJEjYsejkpISFCAnnHHMMWazmXKgF2vQ09MTExMjl8tlMllKSgrnyIgErKqq6u/vR7GbzWaywblz52QyWUZGBmVORmKO8fl8arU6OTl5wYIFVVVVggss8r2VmGPEwhTUJGCOsVgsmZmZ5EWa7Ozs06dP42Jubm5OTk5bWxupZ8B9m+zF6/Xm5OSUlJTwv+W07O/vz8rK2r17N0WE+Pj4zMzM9vZ2sd4BYEoRIMeMjo4qlUq8ftSFCxfS0tKcIa2Tz8FJXfEeg9YGx+0F1+iW6DYb5Lr3gvb9fr9KpZK42hKlAf14mpycbLVaKfMkgg3KyspWrVplsVguX76s1WqPHz/O8Zx8vPH8+fOc91QODw+jNTkoNxpIzDFms9loNHo8HpTMBO/F4HsrMceIhSmoCUV2KW8WYENaUd85Vd8sAAATT4Acw1nj2uFw8N8GIbbASVD/9Ugj/LXB+e3p9gXdZoNc917wOHL27NkVK1YEDEdKvGLh48XtxQ6ygg1GRkYUCoXNZkPFM2fOUFYIZVnWbrcL3mHV3NyMXpYsJQqxSr1ejxP5hQsX+J4Ieislx4iFKSYaRfag3izABrOivnPC3ywAAFOWMD4fo3y++jpZefPmTcHXA5MYjcYNGza0trZardbm5uZxt88HrzdutVqtVqvNZhN7nLipqWn79u3B2g+KhoaG8vLyYBsMDAyMjIy88MILqJiamupyuegdoRfWPnny5MaNG7gyOTnZ7XaH4vdzHj161NPTs3DhQlTU6/V8gyF4S98woGh80JKgJSUld+7cwZWUF0zgNeS//fbbgPseWic/ISFh69atarX6+PHjYm7glvPnz58+fboUz+/cuVNaWspZUR8ApiYBcoxGo4mMjPz9999R0W63S38mcfbs2VqttrW1Fdf8+uuvGzZsoG/14MEDt9v9ySefLF68OCEhAb3TN1j7Ym5rNBqGYe7evYvqHQ4H+jB//nyFQjEwMJDwHPI9N5h79+61tLQUFBQEDj4QarV6eHgYvz/c5XIh3xiGaWlpKSwsjIuLW7Vq1dDQEP8dxoIN5s2bJ5PJ8OGS/0v98MMPK1euxMWuri7U4NmzZ+vXr3/06BGqdzgciYmJYwlNoVA8e/aMFJ9vUNBbiib0DRkJovHZs2ePw+HQaDSpqaloNYenT59evHiRk2M4f1n8fv/o6GhQ+/bevXsPHjz4+PFjuj8S2blzZ2pqanx8vMPh2LNnz7jYBIAwEvBMp6ioKDc3l3PNX+IaxtJXXye34q8Nzm8f0D7fbVQvfd17ci1xRH19PboBgU+wc2Usy2ZlZZlMJnSjRHp6Or7pFr+L5dq1azExMfz3sog1KC0tzczM7Onp6ejo0Ov1nNu6vF6vWq3et2+fx+Pp6OggL5Pk5OTk5+e7XC6r1WowGI4ePSo9CsFKo9GYlZXldDptNpvBYDh58iTflKC3YpoE3FBMk+7ubnLn5BSx/4JvFmBDXVGfL8jUebMAAEwwod+7jBtQcgwrefV1civBtcHFRqOYfSn3LtPXveesJc6ybEpKyvnz5wVVCnj/Er+mv7+/oKAgNjZW7Jl2rIlY7Byp/X5/aWmpRqNJTEzE94yR27a3t6enpyuVyuTk5IMHD5Ke5Ofnq1QqrVZLOVBKr/R4PCi0xMTE+vp6wWaC3gpqImVDMU2+++478voZp8hB8E0HIayozxdkirxZAAAmHlidgkbIa4kHPHZMmLWQtx3fECbFE7/fr9Pp8I1nnCIfeLMAAIw7k7a2/7+CsawlPr6LaY7FWsjbjvt6oBPsycyZM0+fPv3SSy8JFvnAmwUAYNyZxoqsvgeMhYcPH3q93sWLF0+6tZC3Hd8QppQnAABMGJBjAAAAgHAB748BAAAAwgXkGAAAACBcQI4BAAAAwgXkGAAAACBcQI4BAAAAwgXkGAAAACBcQI4BAAAAwgXkGAAAACBcQI4BAAAAwgXkGAAAACBcQI4BAAAAwgXkGAAAACBcQI4BAAAAwgXkGAAAACBcQI4BAAAAwgXkGAAAACBc/A+OB+MFLRd2nAAAAABJRU5ErkJggg==)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAATy0lEQVR4nO2df0wT5xvAT6xamw5rVypixdqxig1jjDjHMkYIMaaShjWGIBKGDN2ChCkjxiEjxqlhjpDFMEf4OmZwI44sCyHEEGeYIR0xrkNSkZGCFSu5dIxVLFhZQeS+f7zZ5XI/3l5Li4jP56/re8/7vs/zvO/dc+97b99bRlEUAQAAAABhIOJZKwAAAAAsWSDGAAAAAOECYgwAAAAQLiDGAAAAAOECYgwAAAAQLiDGAAAAAOEigBizefPmW7duhU+VgFhUygCLgVu3bh08ePBZawGIAhrrxUFsjLl9+/bc3Nzrr78eVm1EsqiUARYJhYWFWq32WWsBiAIa68VBbIxpb2/PysoiCOLhw4cffPBBVFTUhg0bPv300ydPnoiv7P79+y+99BI6WLt2bRDqspR59OjR4cOHN23atHr16i1btnz55ZdPnz6lxS5evLh169bVq1dv3br166+/ZqqxjMHGjRuPHTtGG0IryZJcvnz55s2bT506hapYxkfQFnGrDhSMK4T8QGBdIdIPxLxdEbTVExMTX3zxBTp+8OBBX19fWVmZX28wc4VQGS6ffPLJ6tWrL168GJLSuPA2a6j0x/QZv/i9upmNxeqBy5Yt27x5MxKbnp7eu3cv3hyuzIMHD95//310g2Je1zS7du363//+hzeBKXPv3r333ntv7dq169at+/DDDycmJrj2skzYtWsXOjU4OLhr1641a9asW7du//793LwvBJQ4tm/ffvXqVYqisrKy8vLySJK02+2pqakVFRUiS6Aoyul0yuVydKBQKMRnFFImOzvbbDbb7faxsbHOzs709HSr1Ypkzp8/r9FoLl++7Ha7u7q64uLiTp48yVTD5/P5fL6pqam+vr6UlJSqqiqWklxJm822fft2VA5KtNvtCoXC9x9BW8StOlCEXIHxA9dApitE+oGatyuCtpqroV9viKlu/u1IUZTb7Y6IiLDZbLOzs/MvjYtQs86nC/ktXCR+r26hruXz+U6fPp2VlUVRlM/nS09Pz87OxpjDK5OZmUnfoJjXNcJut6vV6qmpKYx6LBmDwXD06NHR0dHh4WGz2ZyXl8drjo/BzMwMOqXT6Q4cOOByuUiSzMvLy83NxdS7VBEVY1wul0KhmJmZmZqa0mg0Xq8XpVut1ri4OPGVkSSZnJyMDrZv3x6EuixlJBKJx+PhFdNoNCgOIXp7e2UyGdKcex12d3fHx8ejY8ydC0kaDAb65zyDJYugbxAYV2D8wFsj7YqA/EDNwxUhjzH4jhGSu3BAuoUDoWYNSb34PuOXgGLM6Oio0WikTxkMhtbWViRz+vRpvDlcGa/XGxERQTd9d3e3Xq9nZikpKWFFHS5MmbGxMYlEQp+y2WwajQZjDhOfz3f27NnJyUn0s6+vj5v3RUBUjGloaMjJyeGmX7p0KS0tjaIoq9Wampoql8tjYmJ27949MDAgXoMrV64EJEMr4/V6JRIJb9f3eDwEQdBPEwir1SoUY3p6erRaLTrG31t7enqYvZZ7OYkxRwhWdX6LogWEXIH3A7dGiuGKgPxAcVwhpLzVak1JSZFKpSqVKjs7myRJVuE+n6+oqEgul8fGxh4/fhyNA5BMdXW1SqWKjo5ubGxEpiGamppYNxp8x2DlYhbLHGrL5fLa2lqtVqtQKPLy8phBy+VyZWZmyuVyrVZbW1vL6gNutxtfC1Lyo48+UqlUGo3mxIkTTDNRpTKZLCcnx+12HzlyRKVSKZXKwsJCZBSmWVEJZ8+e1Wq1SqUyPz+fVpvreYxjhfoMr9oURZEkuXPnTrlcrtfrq6uraYdgWpO3b6hUKmbVYkImpqOy+qTH41EqlaOjo5jSuDIGg+HcuXMURU1NTRUXF3PHIk6nUyaTHTp0SK1Wq9XqsrIy7uB1Zmbm6NGjBQUFeFuWJKJiTGZmZnNzMyvRbrfHxMSgKQi1Wt3Y2Dg+Pj48PPzVV18NDw9TFKXiwFt4dHR0RkZGT08P71mr1ZqRkREdHc2rTFZWlslk6u7uZt1QSJKUSqVC5rA6osfjMZlMJSUl3LMsybGxMaPRePToUWZRrPsL3hw8rOowRXHdwusKvB+4NTJdEZAfKI4rhJRvaGi4cOGCx+MZHR0tKyszm82swisrK3Nzc4eHhwcGBtLT09Hl7XQ6CYIoKCgYHR29cuWK3W6nKMput6M5itnZWVYhQh2Dm4tVLDPGoFMul2toaCg1NZXuIRRF7d6922w2j46OOhyOxMRE7mM7vhaKooqKikwm08jISH9/f3Jycl1dHV1pfn4+SZKoUpVKVVhYiHRIT08/dOgQvllRCSiLw+HIyMgoLi4W8jyvY/F9hldtiqLMZnN2dvbIyIjD4UhISKAdItSavJGjpKQEGcg0J4Qxpra21u9dniszPDwcGRkplUolEkl8fDy3RyEfVlZWjo2NIfNra2uZAq2trRKJJD09PSTTsM8d/mOM1+uVy+Xj4+PMRJIkdTpdS0sLRVHj4+MSiYTrPpKDUPnV1dVKpTInJ2doaIhOHxoaysnJUSqV1dXVdLuylJmcnKyoqNDr9RKJJC4ujvU8KGQR6hN05Fu5cmVeXh7voz1TUqlUSqXS4uJipqXcGCNkjhhYavMWxesWIVf4vUQxrgjID1xXiPGDw+GIjo5mKalSqWi70IsfWgFWJ8TcXIQ6Bq9dzGJZMYae6Oju7tbpdOh4dnZWKpWiBymKolpbW7kxBl/L7OysXC6nS2hvb09JSaElmVM9ERER9IuB69evo6lpTLOy1L5+/TqtNhPkebwHuAipjRwyMjLCdYhQa3Kr8Pl8CoWit7eXZU4IY4xOp7PZbPipPK7MoUOHkpOTrVbr1atXNRoNGoayNL9x4wb9s62tjfUiYGpqymKxJCQkNDQ04G1ZkviPMa2trRkZGazElJQU+hGGoqjc3NykpKTy8vLa2tqurq4g9BgfHzebzcypT4lEYjabWbPqvMpQFOXz+a5fv06/4vM7jpHJZCjsNTU1RUdHM98BsrosLelyubhDYKH+yjKHdzDHTeS9olhF8bpFyBVixjFCrgjID0Ku4DZrb2/vjh07YmJiULhSKBTMisbHx5kxT6lUqtVqIc/gZ/O43hCTizVXxmudy+VauXIlfWpgYMBvjGHVwiphaGiIvuNjbpH0T/w4RqgErud5dcMULqS2y+ViZqEdElBrtrS0JCYm4s3xazLGfPrWgYkxXJmZmRmZTNbX14cELl26tG3bNrw+drudOcFA09HRgd5Gv2j4X7tMLxSm+euvv/r6+j7++GM65ccff2xsbExMTJyZmSkvL0enojgIVXH37t3S0lKLxXLy5Ek68eTJkxaLpaSk5O7duxhlEKtWrXr77bfr6up++ukngiDQNAVr2eLNmzcfP36MjiMiIjZs2LBhw4Z9+/apVKrGxkYh3WjJ9evXL1++XEgMb46NAS3Gm+i3KF63CLnCrx8I0a4IiR8IgjCbzWlpaRaLxWazdXR0sLL4fL6IiIienh7klr6+PoxzxMDqGEsDMc3KBe/5eRbOS0Ct2dTUVFRUFGgV4qmrq6OXtouXGR8fn5mZee2119DPpKQkkiT91jU3N0cQxJMnT/744w86UafTuVyugPVeAuBD0OzsrEqlokfHdCIrhQm99ELkXFlxcbFcLi8vL3e73axTbre7rKxMLpejOWWuMqy5UYvFQs8MaDSazs5O+lR/f7/QurKWlhaNRkPP/Ih5OqbhPhNhzAkUoaJYbkEIuQLjBwrrioD8QHFcwas8d5UOaxxDUZRcLmdNmAgpgNEQ0zHmP45BU0NOpxP9FDNXxqoFM1cmZhxDCTerUAm8nufVDVO4yLmytrY2Wk+RrYkGT2NjY34luTBlMOvKCIJQKpVoOBUREcH7hphXRiqVOhwOJNDa2opMZtLZ2ZmUlET/bG1tRXNlPp9PIpHQ85Dt7e1BL6Z9rvETY9A0IjedORc/MDBgNBqvXbvmdrtHRkYOHDhgMpnEa5Cfn09frrw4nc78/HyuMmgZ+/nz510ul8fjQWerq6vRWeYaf4vFYjAYTp8+TRfI6rgGg4GeKp1njPFrDh6mY/FF0W6hsK7A+IHCumKeMUZIebVaXV9f7/F4hoaGzGazQqGYnJyUSCR2ux1NwRUXF6ekpPT397tcrpqaGszfPtD6MfSyZ2RkhJ6uwXcMZq7gYgz13/9vnE5nf38/852/+CeVAwcOZGVlcd/5i4wxQs2KKYHreSHdMH2GV23qv3f+JEn29/cnJSXRlfK2JrOxEGfOnEFrEFgEGmMoijIajfn5+fRKDXqOlH7SvXHjRmRkJO9TL69MaWlpRkbG8PBwb2+vXq9vampi5fJ4PCqV6vjx4263u7e3NyEhgXaLyWTKzc0lSdJmsxkMhvr6erwtSxI/MebIkSOVlZWsRFbXn5mZOXHihF6vX7lypVqtzs/Px68ODBquMh0dHenp6ZGRkTKZLDEx8fz588yzTU1N8fHxUqlUr9cz3x5xO25zc7NWq0WLJucZY+aDmCtKCIwrhPzAWyPtinnGGCEsFsu2bdukUml0dHR5eTnKUlFRIZPJ0NXr8/nKyso0Go1MJsvMzERPzUIKnDhxAmX0+XxSqZReXIDvGHSuoGPM6OioyWSSy+VarfbMmTPc+7Vf72HWLgtVyvrJ26yYEng9L+RYoT4jZu0yczE3b2uyGouiqPj4+La2Nq4aXHPww1mKosbGxvLy8pRKZUxMTEVFBWsRNssnQuYzZXw+X2lpqVqtjo2NpReMsTL29PSgP2/odLqamhqmMrm5uQqFQqPRMJ/tXiiWURSFmUnbsmXL999//9Zbby3QzB2WRaUMsNg4fPhwf3//r7/+usD1Dg4OpqWl/f333wtc73NNcI11//79hISER48ehUqNoAsMuSZLGAn+9ODg4MLoIYZFpQyw2KitrZ3nAoHgsNlsOp1u4et9rgm6sUK+k2bQBcKeniJZ+t+PefLkyd69e9FjJvNYDPAFgeeIFStWvPnmmwtT16lTp7777rt//vnn999/r6ysLC4uXph6lwzBNZZcLm9rawuhGkEXGHJNljB+5sqWBvv27Zubm/vhhx9Yx3hu375tMpnu378ffgWB54zffvutrKysv78/Nja2tLT08OHDz1ojAFikBDaOEdptG7ML96NHj9avX887zSW0abbf3bn97rbN2r67rKyss7OTe4xnqX5BAJg/77777s2bN6enp+/cuQMBBgAwBBBjpqenjUbj7OysyHREXV1dfn7+li1buKdMJlN8fLzdbr9x44bb7S4pKUHpBQUFc3NzNpvt2rVrXV1dzH/w4TMiBgcHe3t7CwoK6BSlUun1ernHeOgYU1RUNDIycvXq1ZGRkfr6+itXrvT29iKZb7/9tqqqqra2liTJhoaGurq6U6dO0SXIGfvhd3R08NrCkvR6vW1tbZcvX66uriYIgnfbfDHKAwAALArEL0FzCuy2LZROUdTk5GRCQgK9exIToU2z/e7O7Xe3be723YEuw6WW9BcEAAAAFowAxjGbNm367LPPxKcTBHHu3LkjR47wzqFFRUXp9fpvvvmGIIh///23oaEhNTWVIAi32y2TydasWYPENBrN2NiYmIyIiYmJlpaW0tJS8XbR/PLLL/Rxe3v7zp07V6xYgbaFkEh4FuBNTEyQJJmenk6nvPHGG11dXULlS6VSkaMQqVQqNC7kqgoAALB4CTQoYf61xEr3er0qlUqn08XExFRWVnI3UuTdNBv/NzRMRgTv9t1+xzEv1BcEAAAAFowwrl1GIwyr1WqxWNrb2+vr61kCZ8+ejYuLs1gsHR0dXq+3paVFZMmYjPX19eXl5X6/KE5z586dPXv2GI3GHTt2OBwOlPj48WOLxZKZmYl+Njc3JyQkFBUVKRSKV1999fPPP0cv5GdnZ3nHNzRer5feD1StVkdGRtbU1OAlX3755djYWK1WK/TmBuFwOHbs2LFz5849e/bcuXNHjKUAAADPgECDkvhxjF6vp7fJa29vZ+2JLbRptt9xDGa3baHtuzGDhqX0BQEAAIDFRrjGMQ8fPhweHt64cSP6qdfrWftaB7dpNj6jmO27WSylLwgAAAAsNsIVY2Qy2dzc3L1799BPu90eGxvLFFi3bp1EIqHv7Ha7He3NoFKppqam6L+8kCSpVqvFZCQIoqurq7CwMCoqKjk5eXJyEv/RGsSxY8eGhobUanVSUtLBgwcJgnj69Only5eZMYb15Qz0AV2CINasWaPRaCwWC33qzz//TEtL462oqqqqpqZmenoar49IDh48mJSUFB0dPTQ0dOzYsZCUCQAAEHoCHfiInyszm81Go9HpdPb19RkMhgsXLrCyCG2aLbQ7t9+MQtt3OxwOeq6JeczS/8X5ggAAAMDC4CfGYDY/9yvpdrvRJtuxsbFnzpzhyvBumk0J7M7NzCuUkakM86b8888/059xZR7zsuS/IAAAALBg+NmvLLRbWM+ntKDzTk9Px8fHV1VV7d+/n3ksJA9fEAAAAAgVfvb2J0K9hfV8Sgsu76pVq5qbm9955x3WsRDwBQEAAIBQ4Wcc8+DBA4/H88orr4SksvmUFlpNAAAAgAXghdjbHwAAAHgmLP1vlAEAAADPCogxAAAAQLiAGAMAAACEC4gxAAAAQLiAGAMAAACEC4gxAAAAQLiAGAMAAACEC4gxAAAAQLiAGAMAAACEC4gxAAAAQLiAGAMAAACEC4gxAAAAQLiAGAMAAACEC4gxAAAAQLiAGAMAAACEC4gxAAAAQLj4PxekR8orzHp/AAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAHaklEQVR4nO3bX0hT7x8H8GfHmDrPzDVnzO9sm0VaRN2IdFESXVSYdCFYUZZEYCHDTAjEoiwhRupFEtKFF9VFdLULCfEiIkqGidiwFDWxzT/z36ZZx3VcuvO7eH6/w2H/XOn55fq+X1c+zx4/z2cf4XzY80yFIAgEAABABsyfTgAAAP5a6DEAACAX9BgAAJALegwAAMgFPQYAAOSCHgMAAHJBjwEAALmgxwAAgFzW6DEul0utVsc+vyFiDD43N1dSUqLRaBQKhUKh0Ov1165dW15eFhdcv349OTn56dOnofE1Gs0GJ/1borxT6Uu/Wu0N/OtsnloBQDzajJ9jjEajx+NZc1l5ebnf73c4HDzP8zz/5s2bT58+Wa1W+qrX621ubu7q6iotLZU5300nxgICAMhtM/YYQkhiYmL0BT9//nz58mVra6vRaExMTExMTMzJybl//77NZqMLOI5TqVQHDhxISEiQP99NZ80CAgD8H2xAj+nv79dqte/evaPDpaWlK1eu6HS6rKysu3fvrq6uEkKWl5cvX76sVquNRuOdO3foJD3SaWpqMpvNGo3m/Pnzi4uLJOSoZ2pq6uTJk2q12mw2NzU10aOb6elppVKp0+kIIe/fv9+5c6dGo2lvb5+YmCCEeL1ek8nEcZxCoaBnZZOTk8ePH1er1Tk5Oc+fP6eR6UYNDQ3bt2/XaDRlZWU/fvwI+x6lqaakpJw5c8br9d64cUOn02m12kuXLi0tLYVmHnTQFLYIhJCHDx+azWatVnvhwgVagbDCLotS2NjTDhK2VlHyBwCIZL09ZnFxsbi42Gq1Hj58mM5UVla63e7e3t6Ojo62traWlhZCyL1793w+X19fX0dHx9u3bx8/fkwXcxzX19dnt9u7u7vHxsZqa2tDt7BYLEqlcmRk5NWrV8+ePaOTgUCAYRhxwenTp4eHh3t7ewOBACFEq9UODg6yLMvzPD0rs1gsqampAwMD7e3t0ucmx3Hd3d09PT09PT29vb0PHjyI9E45jnM4HJ2dnQ6Hw+125+bmejyevr6+rq4up9MZNvMgYYtAw9IKuN3umpqaKLuHLotU2PWkHalWa+4FABBMiMrpdLIsG2W+sLCwoqJCnF9ZWWFZdnR0lA7b2toOHjwoCEJ6ejrHcXTS4XDk5+fTIISQb9++0fnOzs7s7OygTVdWVpKSksSANpstLS1Nusbn8zEM4/F4BEF4/fo1fTVskLGxsdAghBDpfF5eXqQ6EEK+fv0qpsowjM/no0O73b5r167QcjmdTjGfsEUIqoDdbqcVCAoVZVmkwtLfjTFtqUi1irQXAEAUW9bTn27evNnR0dHa2irOzM7O+v1+s9lMh7m5uU6nc2FhwePxmEwmOhkIBLZs+e++LMuKh0sGg2F+fj5oi9nZ2UAgIA0YtGB+fl6pVGq1WhohbJ6zs7OEkKysrNAgSUlJ0vmxsTH6Mz2Fo+bm5miqW7duFVNNTU1NTk6mw8zMzDXv2CMVQVqBzMzM0ApQYZdFKaz0F38p7Ui1imUvAIAgv/+Y8Pl8NpvtxYsXFouluLhYfJCF4nmeYZienh7xqSQec62f9NCMHpRtCIfDsVGhqLBF8Pv9Gx5zvYlugr0A4K/x+48JhmFsNltJSUl+fv6tW7foZEZGhlKp/PLlCx0ODg6aTCa9Xq9Sqebn5//5H71eH+MuGRkZDMO4XC4xoLg77Sjbtm3jeX5hYYEQIn4KCQ1CCBkfH6fD4eFh8SWe56XzO3bsoD//IxFjqjQZn8/3/ft3OqRfQKDWU4RI5IgZqVZy7AUAf701egx9gg8NDYlfDxNfSkpK2rNnDyGksbGxtbX148ePhJCEhISzZ89WVVWNj4/39/fX1dWdO3eOEFJaWlpRUdHf3z81NdXQ0FBfXx9jfgkJCUVFRVVVVS6Xiwak8+np6X6//8OHDykpKYcOHbJarVNTU48ePYoU5MSJE9XV1ZOTk9IglHS+qKgoxsTCUqvVeXl51dXVMzMznz9/DrrA/6UiBFU+kt8ubBDxLxulVhu1FwD8i6x5Y1NTU6NSqZ48eRJ0Cy293K6srCwoKKA/cxxXXl6enp5uMBjq6upWVlYEQeB5vqqqymAwqFSqwsJCeocf6YY8aH56erqoqIhlWZPJZLVaxSvo6urqq1evCoIwMDCwf//+tLS02trasHf+giBMTEwcO3aMZdndu3c3NjZKN7JarRkZGWlpaRcvXhTvw4NEv8yXDkdGRo4ePcqy7N69e5ubm6XLQosQPWzYygcti17YGNOOpVaR9gIAiEIhCMKfbnO/YGhoqKCgYGZmhg5XV1fX8y+WLpdr37594tEWAABsrDi7tnU4HNnZ2eLw3/k//AAA8SIOvn5aX1+fmZl56tSp0dHR2tra27dv/+mMAAAgJnHwOebIkSMtLS0Gg6G0tLSysrKsrOxPZwQAADGJs/sYAACII3HwOQYAAOIUegwAAMgFPQYAAOSCHgMAAHJBjwEAALmgxwAAgFzQYwAAQC7oMQAAIBf0GAAAkAt6DAAAyOU/GhLDMo5If+IAAAAASUVORK5CYII=)

Screenshot: fdp-muehlheim.de  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 19 September, 2019 10:54 GMT
Vulnerability Verified: 19 September, 2019 11:01 GMT
Website Operator Notified: 19 September, 2019 11:01 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 19 September, 2019 11:01 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 18 December, 2019 10:54 GMT