Lucene search

K
openbugbountyGh05tPTOBB:988996
HistoryOct 08, 2019 - 9:10 a.m.

softeng.polito.it Cross Site Scripting vulnerability

2019-10-0809:10:00
Gh05tPT
www.openbugbounty.org
5

Security Researcher Gh05tPT Helped patch 6846 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affectingsofteng.polito.it
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: softeng.polito.it
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **Gh05tPT Helped patch 6846 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAMHElEQVR4nO2cb2wT5R/AH7pa265l/7qyrZ20k8zNFxNxLiNBXEw0YUwyIyiZxZFoZkIA52JwaxArvNgcmVE0aHCSjhhNfEHMgoSQJpJtLmbMUgcbHZDJOvYncyselHkrbe/34n5eLnfPPb211B3w/by65+55vv9vX+65HisYhkEAAAAAkAJUy20AAAAA8MACPQYAAABIFdBjAAAAgFQBPQYAAABIFdBjAAAAgFQBPQYAAABIFcrtMXa7/Y8//pAaAvJRSOgUYkbCLIv993vQAEChPebixYuxWOypp57CDgH5KCR0CjEjYZbF/vs9aACA4vaY8fFxo9GIvURRVGtrq9QwSbq7u7ds2SI1lM97772n0+m6urruuYVJwg+sIMhLsjPuWi504lR2dXWVlpbqdLrS0tIvvviCO3/79u1333139erVOp3uiSee+OSTT6LRKKduBY/CwsKWlpa7d+8ihG7evLljx46cnByLxfLBBx+wJ8Vm3C/wKwfFs59wmyQzn6B0qRrv1dpUyAEecBgi169fNxgMci4RZiZARUXF2bNnpYYymZubU6lUPp8vEonccwuTRGAMTdNSl+JCXsuFTnDp2LFjVqv11KlTc3Nz586dW7NmzcGDB9lLW7dura2t9fv9s7OzHo+nqqpqYGCAL5+maZqmFxYWhoaGKisr9+/fzzBMbW1tXV3djRs3RkZGKisrXS4X1oz7AkHlMPHsT6C0+FmTgqxUjoRUrOVQ1A0FKBYl9pipqanMzMxwOIwdyielXTBJ5Ac2GbH80AkuWa1W/t8vr9er1+tDodDCwoJarf77779l2tbX11dSUkLTNH9VX1/fk08+iTXjvoAQRjnz7wnKD5qibihAsch6H/P555/b7facnJwdO3ZQFIUQoijKZrOFQqEVK1Z0dXXxh59++qnRaDx8+PCqVauysrLq6+v/+ecfVs758+efe+45o9FosVheffXVy5cvY9V1d3e/9NJLjzzyiHgoJeHOnTvvvPNObm5uYWHhxx9/HI1G5+fnpSxkN0AWFxffeusto9G4evXqjz76KBqNss/+HR0ddrs9KyvrjTfeYJ1lmZ6e3rx5s9FotNvtHR0dWVlZfJvZtVivxbYJ/OXvOYjtJC8nrxVEkoOiqBs3blRVVXFnnn766XPnziGEYrEYQkitVmNTI0ar1bKPNbFYTKPRcCcXFha4OXwzsO4QorfUNEWj0ZaWllWrVqWnp2/btm1+fp6sVCxHUDniMGJVINxtghA6f/78+vXrdTpdbm7utm3bJicn+VljD1pbW3Nzc/Pz87/99lts0MRlL9inwhanlIMC7VKR5CBkB+s1eT7wsBG/x4RCIZ/P19/fPzAwMDU11dzcjBDKyMjw+/3stonD4eAPX3nllVAoNDAwMDg4ODg46PV629vbWVE1NTU7d+4MBAJ9fX0bNmzQarVYjYSXMVIS9u7dOzU15fV6z5w5093dffTo0ZycHCkLHQ4HQujgwYPsbs+ZM2d6enq+/vpr1tmhoSHW2UAg4HQ6OTN2796t0WiuXbvm8XhOnDiBDRTWa7FthGiL7ZS/XLxWakM/FApptVpB73n22WfT09PT09Orq6u3b9/+66+/3rlzh2AqQoiiKJfLVV1dnZGRsW7dOqfTeffu3du3b7tcrvLycm4a3wwpd6Sit9Q0tbe3ezwej8dz5cqVgoKCkZERslKxHEHliMOIVYG9TRBCXq+3oaFhZmbm0qVLVqt19+7d4lz4/f5Lly653e4NGzZggxb3xpEqTkKgZE4gZ0fKa6n5wMMI+THn+vXrCKFbt26xw/7+/qKiIu4SdieKXRIIBNjzJ0+eLC8vZxgmGAyq1WrsRnAgELDZbOxxKBQyGAzBYFA8lJIQiUQMBsPY2Bg77O7urqysJFjIYjKZQqEQe+zz+SoqKgTO9vX1cc5GIhGtVsupOHnyZGZmpjhQYq/l2EawU2q5lFP8oSCSBI0Cbt261dzcXFxcrFar16xZ43K5uNcSrJumf9FoNHV1dWwYR0ZG1q5dq9Fo9Ho9QojbiOObQYgGNnrMEtPEMIzZbPZ6vXx3yEqxcghhxKog3CZ8rl27lpeXx4huFr5wsVJs2QuKBFucUg4KtEtFUuCdODtSXhOyCTyExN8SMRgM3FN5QUFBMBiMu0Sr1RYWFrLHJSUlgUAAIZSVlbV169bKysoXXnihoKCgvLz8+eef58T29/ezx2fPnq2oqOB2ovhDKQmzs7PhcNhut3Ma2SoncPPmzbm5OZvNxg5jsRi7O8R31mq1cs7Ozs7GYjG+CpleJ2Abn2SWCyLJR61WRyIRqYXs7k1ra+vi4qLX621qaopEIocOHWKv6vV6n8+HEPJ4PM3NzZ2dnTqdDiFUWlp64cIFiqKOHz/+/fffv/jii2IzCO5go7fUNFEUFQwGy8rK+O4QlErJIYQRqwJJ3yYXLlzYt2/fyMhIOByOxWLsVqRgoThHcsqe76BUccZ1UE4EkER2CF5LzQceQv7T72N++OGHzs7OsrKycDjc1NS0Z88e9nxaWlp+fj57TP7VspSEpULTtEqlGhwc9Pl8Pp9vaGiI/bv5IEH45Su7EST4efHvv/8u2Bx79NFH169ff+TIkR9//JE7qVKpLBaLxWKpr683mUydnZ38JXq9/rPPPjtw4IAcM+KSWJrS0tISU4cFa798FbW1tRs3buzp6fH5fKdPn05M6b0qewD470lJj6FpemJigj2+cuXKY489xl165pln6uvrW1pajh8//tNPPwkWRqPRU6dOcXeXYCglwWw2azSaP//8k53g9/u5f/lKkZ+fr9frg8Gg5V+4JofFbDarVKrx8XFOhUyvE7BNoDex5djQcWRkZFit1p6eHu7M8PDwxo0b2WNBp6FpWuqhZ//+/e3t7YuLi9wZt9ttMplefvllrBkEd7DRW2qaMjIysrOzBR/GJ5MCcRixKqT466+/pqamPvzww8cff9xisUi9gIyrFBFvHDnFmSSEO/qezAceYBLvMSaTiabpq1evYodNTU2Tk5PDw8Mul6umpgYhdPny5U2bNv3yyy/z8/MTExNffvnl2rVrOWns36n+/v68vDzuqV8wlJKQlpa2ffv2xsbGiYkJVmNdXV1cgx0Ox65du4aHh6enpw8fPsztBWFJS0urqalpbGwcHx9nVQgsl/Jayrbs7GyapkdHR8U/M+PbKbWcrxS7VhA6MQcOHNi5c+fPP/88Pz/f29v72muvOZ3O9PT00dHRoqKib775Znp6mqKo3t7eXbt2vf3221ghr7/++sqVK91uNzuMRqNtbW384AjMIGdKHD20xDQhhBobGxsaGi5evDg5Oblnz57e3l6Z5YEFG0axCqnlubm52dnZX331FUVRV69e5UdGvlLyjYOIxZkMghrDZofAUucDDyzk1zXiV8r8d90ul0uv17vdbv6wo6PDYDC0tbWZzebMzMw333xzYWGBYZhwOOxyuYqLizUajdlsdjgcMzMzAi3vv/++0+nk5AuGBAmhUKihocFkMlmtVu4dtfjNNt9gmqYbGxutVqter6+urh4bGyM7OzMzU1NTYzAYbDZbW1sb91qVe32K9VrKNoZhmpubWWPIdoqXk9/es2s3bdrEDx12ptvtLikp0Wq1xcXFR44c4c6fPn26qqpq5cqVer2+rKzs2LFjBCHfffedzWZjP+M4ceLEunXr+FcFGSRnChu9paYpEons27fPZDJptdra2tq5uTmyUqwcqYKUUkEQ1dPTU15ertVq8/LympqasGUjkC+n7AULycUpsEpKOzYChOyQ5WOzCTyExOkxCZDMl1nFxcW//fab1FA5+P1+s9nMP6O079EUEjqZZigtehzLEsYklYqLM0mWmh3FZhNYFuR+avffMDo6ShgqB5/PV1RUtNxWkFBI6BRiRsIsi/1JKlV+cQIPFcrqMUrm0KFDBQUFW7ZsGRsbczqd/J9OAcDyAsUJKBaF/t/+CqSqquro0aNWq9XhcOzdu7e+vn65LQKA/wPFCSiWFQzDLLcNAAAAwIMJPMcAAAAAqQJ6DAAAAJAqoMcAAAAAqQJ6DAAAAJAqoMcAAAAAqQJ6DAAAAJAqoMcAAAAAqQJ6DAAAAJAqoMcAAAAAqQJ6DAAAAJAq/gdK9noE9cfXZQAAAABJRU5ErkJggg==)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nO2df1Abx/n/z4qChSwwCCF+KVgQDybUcYjrUJw6HsZJHUIYqrgOIYTalLqEEIqx62Sw4rqUUEwd3PFQl3EyJIMzHpfJtJQyHoZmHA9RKONgQhWiUIViIlNZUbFMgMhEkbHv88d+s9/L3e7eSUjmh/f1l+60t/vss3f33O3dPe8VLMsyFAqFQqEEAdlCG0ChUCiUZQuNMRQKhUIJFjTGUCgUCiVY0BhDoVAolGBBYwyFQqFQggWNMRQKhUIJFjTGMAzDJCUlffzxxwttBWUR8fHHH7/wwgsLbQVFHDpSixwaY5hPPvnk1q1bDzzwwEIbQllEFBcX6/X6hbaCIg4dqUXOEo4xly9fDgsLAz8iIyP9rqezszMvL49hmK+++mrv3r1r1qwJDQ1dt27d73//+5s3b8Jip06duu+++0JDQ++7774//vGPXDNWcLjnnnsOHjx448YNroXCknfddVdSUtKrr74KmliBwu8ewea4rUsn4H7gGRNUP/jd6+np6SNHjoDf165dGxoaqqqqIjuEu0kALUGyb9++0NDQU6dOBapCLoQxDUgXcPVLgXx080aKtxOuWLEiKSkJ/PXNN988++yzhO4gC1y7du2nP/1pdHR0QkICd3+GPPHEE6+//jrBfl6Bzz///Mc//nFkZGRMTMwvfvGL6elpwrbLBHbJYrPZVCoV+BEREeF3PRkZGe+++y7Lsjt37jQYDFardWJi4ty5c1lZWf39/aDMG2+8odPpzp4963K5enp61q5dW1tbyzXD4/F4PJ7Z2dmhoaHMzMxDhw5xLUSWNJvNGRkZoB6w0mq1RkREeL7F7x5xm/Njw4D7gWdMUP3gd6+FFoo6RLSt+Q8iwOVyyWQys9k8NzcXkAq5iI5p8OqXAvnoJhxiHo+nrq4uLy+PZVmPx5OVlbVz505cd3AFcnJyCgsL7Xa71Wrl7s8Aq9Wq1WpnZ2dx5gkLpKWlvfzyy06nc2xszGAwFBYWijlgybOEY4zdbt+4cSP4kZGR4V8lDocjIiLC6/XOzs7K5fKpqSlkMZ1OB+IQYHBwUKlUut1uFnUc9vb2pqamCv9ClkxLS+MWmE+w5OHfCSIYfmCJZ3A2oH4IeIwhOCQgp2BfbQs4Po1pYOuXgk8xxul0Zmdnw8W0tLT29nZQrK6ujtAdZAG32y2TyeDQ9/b2pqSkcLcqLy/nRR0evAITExNyuRwums1mnU5H2Hx5IBJjhGdJMN5gfWNjo16vj4iIKCwshCPR39+fmZmpUCg0Gs3OnTvtdjuvvFKpzM/Pd7lcBw4c0Gg0arW6uLgY7nMej6ekpESlUiUmJh4+fNjXC7fu7m6fCpw8eTI/P59lWbfbLZfLkbv+1NQUwzBer5e7sr+/H3ccDgwM6PV64V/Ikty9Vng4iXaHAK85iZ4Jhh9YsRjjnx8Iexosg9ydQJn6+nqNRhMbG9vS0gK6BmhtbeVWgnMIchNuncIuI48Xh8ORk5OjUqn0en1jY6PwfOpyuWBDx44d47UCjSwtLdVoNDqdrqamZm5uTuIRJ2VMjx8/rtfr1Wp1UVGRlMNc6Fhc/UKzQQG73b59+3aVSpWSklJfXw99IhxNQtjo7+/XaDTcpkVDJvmA5e2WU1NTarXa6XTiakMWSEtLO3HiBMuys7OzZWVlBQUFBHuWB/4/j3G73UNDQ319ff39/ePj40ajEawfHBwsLS11Op0Wi0Wn01VUVMDyZrO5t7fXbDY7HI7U1FSXyzU0NHThwgWbzQY3r62tBTMt3d3dJpPp5MmTYH20AKRVxcXFjz766EcffST86+LFi48++mhxcTF3JXwYs2rVqpycnIKCgn/+85/Xr1/n9VShUNx9993clQ899NCqVauErUxPT9fU1OTk5Ii4j2GuXr166NAhg8FAKEPojq9I9MwS8gNuT+OC253cbrfVarVYLK2trVu2bFm9erXVagXTLEVFRdwacA4RbsKrk2cJ7nipqKgICQkZHR09d+7c22+/LexCVFQUbOipp55CtlJZWelwOAYHB7u7uzs7O5ubmxlpR5zomIJKgNkOh6O6uprsfJ555PqRZgOfhIeHDw8Pd3V1nTlzRnQ0kbS2thYWFvKaDiAtLS25ubkxMTE+FTh79qzRaAwNDQ0PD+/p6WlpaQmSeYsIcggi3McwDDMzMwPW9/b2JicnCzcfHR2NjY2F5bl3nTKZDE5T9vX1rV27FvzWaDTwmhHM1IPfdgFIg91ud319vVqtzs/PHxkZAStHRkby8/PVanV9fT33gtTtdqtUqsnJSbA4MzNTXV2dkpIil8vXrl0LL6zIlz+ga5pvCQkJKSwsRF7ac0uq1WqFQlFWVsadshdevyO7IxHhjb9EzwTcD6zgPibgfuDuaVwjkbsTMACOO9JCbiVSHCKsU/iv8HiZm5tTKBRjY2NgfXt7O3JeiPvoUWj53NycSqWClXR2dmZmZko84qSMKTS7r69PymGOcwIPpNnQJ+Pj40KfCEcTV7/H44mIiBgcHOR1J4D3McnJyWazmTCVhyxQWVm5cePG/v7+d999V6fTwTvRZcy85sqE61mWHRwcfOyxx+Lj48EZRLQ8d3FycpJ7nlKr1Vqt1o9eTU5OGgwGOPUpl8sNBoNwSr29vX3btm3CzT0eT19fH3zEZ7fbFQoFri2bzaZUKkHYa21tjY2NhUeysNewpMPhEE4D4vZXXnc0HHBrhK375JnA+oEVnHAD4gfRPQ23OyE9Q57NQzqEvAnhX9hBh8MREhIC1w8PD4vGGKFhvEpGRkZiY2MlHnGiYzqfw5xcP9JssJ67CfQJcjRxI9XW1rZhwwZyd6T0F9d9eOrA7avIAl6vV6lUDg0NgcUzZ85s2rSJYM/yIPDvLhsMhq1bt5pMJrPZ3NXV5dO2Ho9HJpMNDAyYzWaz2Tw0NGQ2m8FfEufKGIa5dOlSRUWFyWSqra0Fa2pra00mU3l5+aVLl7gl4UQZj5UrV27evLmpqemdd95hGAZMU/BeW/zoo4/gzIlMJktISEhISNi9e7dGoyHc/8KScXFxd911lxSfCLtj5oBbI7EqnGeWhB9E9zTC7uQfPIcsA0THFIfEw9zv+oX4NJqtra0lJSW+NiGdpqYm+MK09AKTk5Ner/f+++8Hi+np6Xa7PVgmLh7IIWhmZkYmk3Hv8cn3JcIXJ3y6j2FZVqVS8e5wARLnysrKylQq1f79+10uF3e9y+WqqqpSqVRlZWVgzdzcnEajgbfqLMvynuuaTCY4M6DT6c6dOwf/slgsuHdv2tradDodmPkRfebPQ3hNhOuOH0j3TMD9wEq7S4BI8YPEPQ25O/l6H4NzyPzvY8C8kM1mA+ulzJUJLcfNlUk84qSPqa+HObl+iXNlHR0dhJMDskVw8zQxMcFb7+t9DOG9MoZh1Go1uJ2SyWS8KQRCAYVCMTo6Csq0t7eDLi9vxN9dzsjI2LNnj9PpHBkZ2bJli2jM0Gq1zc3NU1NTIyMjBoPB1xhTVlaWmZlpsVgcDsfRo0d9epWeZdmioiJ4xAqx2WxFRUXgt8lkWr9+PfwLvMn+xhtvOByOqakp8G99fT34l/uOv8lkSktLq6urg3Xydty0tLSTJ08ie+3ruZXcHVG4DzkkeiYYfmDFTsdCY6T4AbmnzczMyOVyq9UKpuCQuxPSAPD+GHjYMz4+DqdrCA7hbuJfjGG//fjGZrNZLJYNGzZw36ESVoVz3Z49e/Ly8sbHxy0Wy8aNG5uamqQfcdLH1NfDXLR+odlgvcFgAO+qWSyW9PR0wsmBO1KQhoYGg8Eg9JKvMYZl2ezs7KKiIofDAc5+8EVkeKV74cKF8PBw4VUvrkBFRcW2bdvGxsYGBwdTUlJaW1sJ9iwPxGPM6Ojotm3bVCpVWlpaU1OTaMwwmUybNm1SKBSxsbH79+/3NcZ4PJ6qqiqdTqdUKnNycrj3GYHlwIEDRqORu6arqysrKys8PFypVG7YsOGNN97g/tva2pqamqpQKFJSUuDBwKL2y9OnT+v1eq/XO/8YMx9Em8MRcD+w844xSJB7Gsuy1dXVSqUSHL3I3QlnQE1NDdjQ4/EoFAr4cgHBIXATv2OM0+nMzc1VqVR6vb6hoQF3vJBjDO7dZZxLeYsSx9TXw1y0finvLnPf5xaOJm+kAKmpqR0dHUIzRI9H4ZqJiYnCwkK1Wh0fH19dXc17CZvrE1zfea72eDwVFRVarTYxMbGxsRHX7nJiBcuyCz1dtzCsW7fu7bff/sEPfrDQhlAWI3v37rVYLO+9997tbPSzzz7bunXr//73v9vZ6FLH75G6fPny+vXrv/rqq4CYMZ/aAmvJYkO+0AYsGJ999tlCm0BZvDQ2Ns7zBQE/MJvNycnJt7nRpc58RiqwyTTnU9syTuu5hHNiBoMbN248++yz8EKSt0iGCgQsTvwbl7vvvvuhhx4Khj08Xn311TfffPPq1asffvih0WgsKyu7DY0uJ3wdKagFoFKpOjo6AmXGfGoLrCWLDRpjvsPdd98dEhJy4MAB5CIBKhCwOFn845KVldXc3KzT6YqKiiorK3fv3r3QFi1zoBZAVFTUvffeG6hq51NbYC1ZdJAf19hsNl55kHLOarVmZ2eHh4drtdqSkhLCR3wFBQW8x1nIlYCZmZnY2Fir1YqsbWxsLC8vLyIiQqvV7tmzBzTqcrmKioo0Gg3uoRxuQ0h2djZ8/Yll2cHBQfAtGHIRR11dXUVFBexFZWVlYmIieMjZ0NAAH2bCh5+pqanch5+swNU6nQ52h/f0GJaRyWR6vb62thbW7+sQ9/T0pKenK5XKzMxM+GnYbUD0qT73Kfd83oOA47KEBkWU+TwiJviBxbtCoh9Yoivm7we/Oz41NQVeBQQZrLnv7OEcAjcJrCV3IJK+8/dwADtWcnLynj17HA6H3W4vLCxEZnZDpssmJ9muq6s7cOAAzhhkWmxy8m3ChgBh8m1fXwYDQIEAFp8KnpzknOtqgkYArxg3MT7re2782NjYjo6OycnJmpqa2/nJ8W2LMaLCDYtwUESZzwluSQtY+N1xwot5Cy7csOzxLZcMwOPxHD9+HH6YOTQ0hMxQbUOly0auBMzMzKxfvx5WywOZFls0+TZuQ7gozM7tR4yBAgEsMRU8Ocm5sCGkRgCyGDcxPuvLeVmj0YDX9s+ePSvMvRE8RC28bcINi3BQRPH7VLvUBSwCHmMWg3DDskf8ecytW7f27t0bExMTExOzb9++mzdvrly5cu/evUAw7saNG6dPn962bZtwwzVr1rzyyitSVgJOnDhx4MABnFBddHR0SkrKn/70J4Zhvv7665MnT27ZssXlcimVytWrV4MyOp1uYmJCyobgr+np6ba2NmS+XlH+8Y9/wN+dnZ3bt28HGV5v3brFMIxczn9hb3p62m63Z2VlwTUPPvhgT08PoQmFQuHxeEQtUSgUc3NzEk3lUV5enpOT8+KLLxqNRm6CW6GCJ9QiBH+99tprMTExkZGRu3fv/vrrrxmGeeqpp1577TVQ5uOPP165ciXU+Hv++edfeumlK1euPP7442FhYevWreO2hSQhIQFkWU5ISPjwww9FO4IsAMdlaQ2Kr0ipCpTB+YHx3RUS/cD464qLFy9u3rw5NDQ0Ojr66aefvnLlirDMN9988/Of/zwsLGzNmjW/+c1vbt68CXbOI0eOREdHx8XFvfnmm6Brer3e7XavWLHir3/9K7cGwo4BNzl16pSwWp6ua1hY2LFjx5KSkiIjI5977jm453/xxRdPPvlkWFhYUlLSsWPH5iPXu4QhhyAwu2o0GicmJkZHR9evXw+/G2JZtr29XS6XZ2VlEW4bkZcDwpVut1uj0SQnJ8fHxxuNRqRszNjYWHh4uEKhkMvlqampbreb/KEZYUOwvrGxcdeuXWTbhKb29/dv27aN+5AmJyfn9OnTcDEvLy83N7e3t5ebg4ScfFDY0NTUVG5ubnl5OUu8ZJ6YmMjOzn755Zd5VXH9EBsbu23btoGBAWGjR48eValUSqXS4XCQnQArBLvEzp07x8fHwS5RU1PDsmxLS8v27dtBmbq6Orlc3tbWBhaTk5PPnz8PPt6GW3GT6fLAuYjQEeGgsN8dlyU0KKLwmiNXxfMM0g+sj8kxcX4QLgpdITxIkfafPHnyrbfempqacjqdVVVV4Lt9XuVGo7GgoGBsbGx4eDgrK+vEiRNg59y1a5fT6ezu7oZPdqE4wtjYGO9wxjkEbgI+aOVVK3wat2vXLpgOAHiGZdkdO3YYDAan0zk6OspN4nBHIRJjPB7PhQsX4GJHRwd34mJ2dhak1uA+M+chMcY0NjYaDAaXywVOQLxHrwBhWmyJMQaXTxuZfJtwzCAz4fMEAlhMKngpH7czEjQCbGKJ8YV+wCXGb2lp2bBhg9PpzMrKAq9yjI6OIjMTC2MMN/U6eJDjcDiUSiWwJCMjY//+/eC5l81mCw8PB99jIxO2S8xEh+vIfIQbFuGgSIFnNq6q2yPcgHzmv1DCDTaU9gF3Q2E3F1y4Ydnj23sdVqtV+JJVV1cXmDpHIjHGpKSkwBNQZ2en8PkzMi22lBiDy6eNy85NiDHITPg4gQD2u6ngpVwyS9EIsIklxsf5gZcYn2VZrVYLMgw6HA6NRlNfX3/hwoX09HSkE7gxhpd6HeovpKennz9/3ul06nS6qakprVY7NzfX0tKyY8cOXMJ2PwigcMMiHBQpwg3IY0pY1e0RbhDuKgso3ICLlIQYg3MI+Xkb4V/YQYnCDcsen2OMVqv1er3wXRQWE3ggUmLM5OQk99iwWq3x8fG8TZxOJ7fM8PCwqEgGYUOWZbOysjo7O4VbEWIMuNoqLCyEmVNZli0uLj5+/Diu+yzL9vf3p6SkIEVnBwYGcI+XuTdz5N1diNAPo6OjIO0SfB2T9yrE2bNn5XL5jh07wJu+/sUYo9FoNBpbWlpACuft27efP3++oKCgpaWFEGOkz5UhO4IcFFZsXBbnoLDfvavDrRE2h6wK5xmhH1iM6DJ0hUQ/SHEF8iAV2p+YmFhbWzs6OgrSSgpjjMPhkMlkNpsNOsfhcMwnxvAcQmNMoBCJMefOnQMXtoD29vaMjAyPxyOXy+GdY2dnJ+HNHykxBihDwJvKjo4OZMprYVpsKe+VITdk8cm3yccMLxO+UCCAxaeCJyRRFzaE0wjw43SGzOoPbuS5UxOlpaUMw1gsFhav6cAK5so6OjrgTWdfX19GRkZeXl5XVxfLss3NzZWVlbGxseB6FpewXfpcWTCEGxbVoPgHoarbINww/xgTQOEGP2LMggs3LHtEYszU1JRGozl8+LDL5RocHITXL7m5uQUFBXa73Ww2p6WlNTc342qQOFdmMBiys7NtNtvQ0FBaWtpbb70lrAqZFhuXfFt0Q1zy7dHRUe6uwFuE9oNM+DyBAJaYCp6Q5BzpE6RGgB+nM1xW//Ly8ocffthisbhcrtbWVo1GExsbCx2I1HRgv40x3NTr4Jk/QKvVarVacPax2+3h4eHwGgWXsF06wRBuWGyDIhHpqg0sxzNLSMDCP+EGXOtQhYGnBbAYhBuWPeJzZQMDA1u2bFGpVMnJyUePHgUrJyYmCgoKIiIidDodYUeUvtLlcoGb5cTExIaGBmQxZFpsZPJtKRtyjeHu9H/5y1+4X4rwFnkIBQJYYip4XJJzpE+QGgH+Tcsg8Xg81dXVer1eoVBs3Ljx9OnTY2NjSqXSZDKxGE0HaEBDQ4NWq42IiNi1axf3C9bCwsKdO3fCxU2bNkH/4BK2BwOfhBsW1aBIQUpzOJaKgIV/wg2E1oEKQ0tLC+/2fcGFG5Y988ppwSPgvvO7Qr839Hg8er0evnjGWxSSkpLCfe/uTmBJHCF34LhQJFJZWYl7SSeogHum29/ughPg3P4Bz1Dtd4X+bbhy5crTp0//8Ic/RC4KoQIBixM6LhQcC6LawNzBwg2BzLusCnSGar8rnI8lvIhCCDAMJ084ZSnC1W7wSceBoVIOS5bbptrAUOEGhmECG2MCnqHa7wpvW65smCecshThajdI13FgloJkAGUxQIUbGEZabu2qqiqFQgGeswUcZDrxQE36E9K2iyL6cJKbJ9wmEEHQ6/WgGEHLAIIsQ5Yt4EkSIOGWIQscILsAPv5npUk54Lrpn5QDzlpRKQfRbhKkHCTqOLDSJANYv1Lls4LnybDYPFPlB1DHYZ6HJ3dzcgp9AM7JS+LRIEU8xoAzqdlsRn69PE9w6cQDsveQ07aLIhpjhO+WwIzldXV1eXl5rJiWAQBXhiBbIJQkEMIrQxA4QHYB6jiwEqQccF3wW8oBZ62olAO5m2QpB+l7nahkAOtvqnykSQFJlR9AHYf5H57QVClVEZx8R70EvEQRjzFBvVjApRMPSKPktO2i+BRjnE4nvOpnWTYtLa29vR2UwWkZcOsRliF/XiqUJBDCLUMWOBB2h4sUKQdcNwndJ0g54KwV/eRWtJtkKQeJe50UyQDW31T5oib5nSo/gDoOATwniFZFdjJl8SMSY1wuF7wNP3bsmEqlqq+vBx/rgTd63W53aWmpRqPR6XS8dHKNjY16vV6pVObn57tcrgMHDoCP6ouLi8GRhkxf0d/fD2PM8ePH9Xq9Wq0uKiqCO1l/f39mZqZCodBoNOCbPtgi1zZC5eA30nLuNxz19fXcb6ZKSkpUKlViYuLhw4fJt+r9/f0ajYbbtMTvJwjfGXBPJVNTU2q12ul0EmoTlklLSztx4gTLsrOzs2VlZcJ7EZvNplQqKysrwXeUVVVVwjtXr9f78ssvC5NVk7uJXF9fX0+YfUVaS/CJlG4i/SYxxnR3d8PfJ0+ezM/PZ7/9TA951ULe/YQNDQwMwMlVskkDAwPcyCp0AtdULocPH96wYUN5efmGDRtANgeebeAzuPj4+B07dgwPDxO8jftGSuKBD2sGXgLgdgaCk3kWOhyOnJwc8DEK/ACLa1JERERhYSENV7cZ8fsYblpsRpA3u6SkJDc3d3x83GKxbNy4EUw6g0nkoqIiu90OvhLXaDTFxcXga/ysrKzKykqWmIYP1AA2AR8DwmQYuKTfPNtE0x0iLcflnxdmEWfxp6Ty8nLQQW53AhhjkJIEPIRlcAIH3CYYvI4DK0HKQXqMEZVyQForJcYQuikq5YC0nyzlEPBU+WST/E6Vz+J1HABarbalpWVycnJsbOwPf/iD8HtGXoxhUPoOEg98bs3cFPosJnkdzsk8C5GJ9G34xPuU24MPc2U2QYLrubk5lUoFs0J1dnaCVGCgJHdOQyaTwUnwvr6+tWvXssQzr+276bL7+vpgViUu3KTfDD75thCk5bycWtz8QsIs4rgmPB5PRESExDRKhDKEIxwpScBDWAYncMC1nKDjwEqQcpAeY0SlHJDWSokxhG6KSjnw6pci5RDwVPlCk5hApMon6Diw3yalFYoRkGOMUN/BjwOf1woyeZ0UJ+MS6dswifcptw3fYgzvsOElFh0ZGUHKPAiParBIvo/B1SCa9BtAvpBEWo7LDYzMIo5slGXZtrY24WR3AGMMTpKAi7AMTuCAAC6dNkHKQXqMIUs54KwVjTGEbkqRcuDV75OUQ6BS5QtNCkiqfIKOA6CgoCA9PX3//v2NjY09PT1Cb/BiDDL3tsQD349nYABC+n1ckmMp1yWUoBLI72N8Bdwj37hxg7vyo48+un79OmErg8GwdetWk8lkNpu7uroCWzkSkBZ6YGDAbDabzeahoSHCd8Ktra0lJSW+NiGdpqamqqoqX8tMTk56vd77778fLKanp9vtdtG2gBLtjRs3Ll68CFcmJyc7HA6f7ebw5Zdfjo2N3XPPPWAxJSWFV6F/1pI3lOI3HrW1tSaTqby8/NKlS3BlZ2dnXl6esPDKlSs3b97c1NT0zjvvMBJ2P5lMlpCQkJCQsHv3bo1G09LSgjMDloyLi7vrrrukWH7p0qWKigqTyVRbW8swzNWrVycnJx988EGGYeLi4lpbWw8fPnz06FEoOs4wzJ///Gdwr+P1evfv3//LX/5SSkMBJ1oA91+ekylLgnnFGK1WGxIS8vnnn4NFq9Xq0weJq1ev1ul0JpMJrvn000+3bt1K2OTq1asOh+PXv/71vffem5CQoFAo/KscablWq2UY5r///S9YOTIyAn7ExcUplcrJycmEb4mLi0M2euXKlZ6ensLCQtG+i6LRaGZnZ6EwuN1uB+b19PQUFxdHR0dv3LhxZmZGeBwiy6xfv14ul8NzJXKk3nvvPXAaAgwPD4Myt27devjhh7/88kuwfmRkJDExcT5dUyqVt27d4jqfV2FMTAzSWpxPRDdkpPmNx8GDB0dGRrRabXp6OsjmcPPmzbNnz3JjDO+SBTxXYHzctw8dOnT06NFvvvmGbI9EXnjhhfT09NjY2JGRkYMHDzIMo1ar5XL5f/7zH1DgySefLCkpaW9v5312/v3vf3/37t0HDx586623Ojo61Gr17OzsV199Bf7lhXmPx8M9Uua5S0DMAhi8k7lotVqZTHb58mWwaLVaA2IPJQCI3ukQ5spYlt2zZ09eXp7wmb+UW2YWn06cUAMy6TfSNnLadqTluPzzwiziLMvy8oSzLNvQ0ADeQcD5UIqfIUjZApwkARdkGaTAARecjgMrWcpB+lyZqJQDzlpRKQfchlKkHJA6DsB+pJRDMFLlsz5OJQknf5Cp8sk6DsPDw9nZ2efPn3e5XOPj43v27MnNzWV913fwY66Mm0IfCcHJvOaQifTpXNmCM98YQ3h3mVsDLsawmHTihBqQSb9xhyIhbbvou8vc/PPCLOJgJS9PeGpqakdHB8GHyEXcSqRsAdInhJM7twtCgQPehkgdBxYl5SCxC7j1QikHXhmcHIPQJxI3RPqE/a52A1nHgfVRMoD1K1U+O+8Yg4Ss4+D1emtqalJSUkJCQrRabVFREXjDm6zvcPToUeS7yzjbkDGG5evdpPEAAAehSURBVKTQxxmPczKvHimJ9GmMuf0EMrf/HYh/ecJ9es4Z1Apv/4aLyhKudoOojgNLJQOWDndsIv1FSIBz+99p+J0nfKmLIMxnw4BX6PeGXO0GUR0HhkoGLB3u2ET6i5AVLCa5HiV4XLt2bWpqKoCZof2u8PZvuPgtoSxRXn311fj4+Ly8vLGxscLCwsOHD9+heY4XGTTGUCiU5cAHH3xQVVVlsVgSExMrKir27t270BZRGIbGGAqFQqEED/HvYy5fvhwWFiZa7P3333/wwQdXrVq1efPmTz75xD9ruG0R2r18+XJkZCRc3LdvX2ho6KlTp/xr1FckGim6ra8FRLe9evXqc889FxUVlZCQsG/fPuH3Fk888cTrr78u3VqfWofFuENDoVDucAL2nX9BQUFNTY3dbs/Ozg7Ih+5r1qzhZn3Gce3ataampgsXLhQVFc2/0cWMqEN27dqlUCgsFovJZBoaGjp06BD3388++2xwcHDXrl1BNpNCoVD+PwGLMXNzc5s2bYqMjNy0aZPX6w1InStXrhQt43a7lUrlAw88IDHNxpKG4JDr16/39PQ0NTXFxcXde++9DQ0NHR0d3AJNTU2lpaWhoaHBN5NCoVD+Hz7EGDBbcuzYsaSkpMjIyOeeew5m9WAYpry8PCcn58UXXzQajWfOnOFu+Mwzz/zud7+Di5s3bwbzWhcvXty8eXNoaGh0dPTTTz995coVYXNw8cqVK48//nhYWNi6detg/deuXdPr9W63e8WKFadOnbp+/frzzz8fHR19zz33/Pa3v7158yas58iRI9HR0XFxcW+++Sa3I6tWrXrmmWeuXbv20ksvRUdHR0VF/exnP/MjpxnDMJ9++mlUVNQHH3wAFsm9g2UeeeSRsLCwhISEn/zkJ//+978JFXIdIuzpqlWrvv7661WrVoECXq83JCQEVjU9Pd3W1lZRUYFzL3eOS9RynmHIoaFQKBTG1/sYt9s9NDTU19fX398/Pj5uNBrhXyBVfmtra3d39/e+9z3uVvn5+fCa+osvvjCbzQaDgWGYwcHB0tJSp9NpsVh0Oh33DCikoqIiPDx8eHi4q6sLnsiioqKg/kRRUVFlZaXD4RgcHOzu7u7s7GxuboZmW61Wi8XS2toK8gC63W6z2dzb22s2mx0OR2pqqsvlGhoaunDhgs1mg/0iZ+jjMj09vWPHjoaGhkceeQSskdK73Nzc4uLi8fHx3t7eLVu2cNOvCSvkgusppK6ujjst1tLSkpubGxMTQ/AwhGy50DDk0FAoFArD+JivjMEoMZDVKWZnZ8PDw0Eu9+bmZiB0zwMoweCyaBCUXWAxspgNT1qGkaBywWLULJBG5uTkELSPuDo3cFuyaIewQtGeQmpqah577DFuHnihdIrEHBtCy3mGEYaGQqFQfLuPUalUcIJFp9MBYRWGYYxGY2tra0xMzJkzZwYGBo4cOeJyueLj48G/oaGhOTk54Famvb09Pz8frP/Xv/71ox/9KCEhITo6OiMjw+Px4NqdmJhgGAZmg09NTUWW8Xq9SUlJsAyIJcBs3stOKpVq9erVsCPh4eHwQUV8fDx8tJ4gAGneK6+80t3dvWnTJu5K0d5FRkbu3LkzMzPzV7/61bFjx95//31yhVJ6yjDM3//+97fffrutrQ0+oPrb3/6m1+sfeOABZG1CCJYLDZMyNBQK5Y4lAM/8pahTgOmyL7/8sr+/H6ZGl6gEs4BImSubnZ1tb29va2urrq7mPqCS0jukaAeuQil8+umnZWVl7e3tUVFRcKWv0ik4y+djGIVCuUMRvdPB5V2GsytgtoSbfri0tJRhGIvFAtd4PB61Wn38+PEdO3aANRMTE1Ckj2VZs9kcEREhca6so6PDp7kyXs5E6WmhpcyVyeXy4eFhlmVzc3MrKioIvUMawy2j0+lwFUrp6eTk5Nq1a8+cOcOrmWEYtVoNFDxlMhlQ85yZmZHJZNyZT2AhwXKkYYShoVAolADEGFZMnQJQWFgYHh7+zjvvwDVCJZiZmRm5XG61Wufm5njN4ZRduMWkiNmQOyJcFIIz0mq1KhQKKPSL1LnhbosU7SBUSO7p3NzcY489VllZ6eEACuOkU3DqIKIKPTzDcENDoVAogYkxZHUKQEdHh0ql4uqWI5VgqqurgZgErzmcsgtP70hUzIbcEeEiEpyRlZWVW7duJfSOuy1StINQIbmn3EcyAGEveF3DqYNIUejhGoYbGgqFQqH5ypYMly9fXr9+PdS+pVAolMVPwL7zp1AoFAqFB40xS4MbN2709fXpdLqFNoRCoVB8gOpgLg1KS0s7OztbWloW2hAKhULxAfo8hkKhUCjBgs6VUSgUCiVY0BhDoVAolGBBYwyFQqFQggWNMRQKhUIJFjTGUCgUCiVY0BhDoVAolGBBYwyFQqFQggWNMRQKhUIJFjTGUCgUCiVY0BhDoVAolGBBYwyFQqFQggWNMRQKhUIJFjTGUCgUCiVY0BhDoVAolGBBYwyFQqFQggWNMRQKhUIJFjTGUCgUCiVY0BhDoVAolGBBYwyFQqFQggWNMRQKhUIJFjTGUCgUCiVY0BhDoVAolGBBYwyFQqFQggWNMRQKhUIJFv8HzUNJFvlOtfgAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAGfklEQVR4nO3bX0hTfRgH8LMp29Qtt7mzpk7TjJIICdqFwTLwLhAqypKQrJsVYRaDxIRoQaQU3YxVNxZ21Z2EhHRVICMqZY5YupzU/rS1cq5Gc52ddHsvzvuO0+b+uO28r698P1c7+/2e5zznd+HjOb8dXjweJwAAADjA/68LAACATQs9BgAAuIIeAwAAXEGPAQAArqDHAAAAV9BjAACAK+gxAADAFfQYAADgykbpMS6XSyKR5DfKtaxnz6W8xcXFzs5OmUzG4/F4PF51dfWlS5ei0WiB9SSdOhQKDQ0N5ZFnvbEAALngbZz3/KPRqFAozG+Ua1nPnnXC0aNHY7GY0WhUqVQEQTidzgsXLrS1tV2/fn29xbhcrj179vz8+TP11ElDWRUSCwCQ1Ua5jyEIIvPf6P+wweRy9swTfv/+/ezZs5GRkW3btgmFQqFQuGvXrlu3bo2Njf0LtXEUCwCQVZYewzxOuXv3bmNjY0VFxcmTJ5eWlq5cuUKSZFVV1dmzZ5eXl5mZU1NT+/fvLysrI0mys7PT6/UmPYpxuVwymYyddmhoiCTJ6urqhw8fsifz/kT8+VRneXn53LlzJEnW1dXduHFjdXU175rXTJW5tqmpqQMHDkgkktra2mPHjs3NzeVSnt/vFwgEJEkSBPHmzZumpiaZTDYxMfH582d2zXfu3Nm6datMJuvp6fn161cu18s+dSgUamhoCIfDPB7v8ePHBcYCABQu+31MOBy2Wq1ms9lqtfp8vubm5kAg8O7du9evXzudzsHBQWaaxWLR6XR+v99ms6nV6t7e3qxp7Xa7zWYbHR3VarXsIeof/f39XV1dSYF9fX0+n89isTx//nx8fPz+/ft515wuVYbaOjo6zpw543a7zWazVqsViUS5lBeLxfj8v5e6t7f3xIkT8/PzFoslFouxa3779u309PT09LTFYrl9+3bu18uorKy02+1isZiiqO7u7gJjAQCKIJ6R0+kkCOLHjx/Modls5vP5kUiEOXz16tWOHTtSoxYWFlQqldPpFIvF7FRSqZSdNhgMskfZk+PxuM1mq6+vDwQC7NGVlRWxWPzx40dmzvj4eGtra341p0uVobZgMFhaWkpRVOoZM5eXmBCJRPh8PnNRL168SFoQt9vNHI6NjWk0mnQJ2WuVusiJw6xrlSEWAKAoSrM2IbFYXFlZyXxWq9VbtmwpKytjDmtqagKBAPN5Zmamv79/dnaWpulYLMb+Dz1d2sSjszXpdDqj0VhVVcX+8tu3bzRNNzY2MofNzc3MX+c8as6QKl1tMpns+PHjra2t7e3tNTU1Go3m4MGD6yovGAwKBALmotRqNXtIJBLV1dUlAt1ud+7Xu6ZCYgEAiqJoe/5Hjhxpa2ubnJy0Wq0TExMFZrt379727dsPHz5clNqK6MmTJyMjIy0tLTRN6/X6ixcvriuc/dAsaxsGAPi/K06PWVxc9Pl8165da2pqqq2tZXYp5HJ5JBJJ/BY2sb+dldfrNZlMRqMxdUipVAoEgk+fPjGHdru9oaEhv5rzTrVv376enp6rV68+evTo6dOnueTk8/lMR5HL5RRFff/+nSAI5k4lgaIoj8fDfJ6fn6+vry+kyAJjAQCKojg9hiRJuVz+4MGDUCjkcDgMBgNBEBKJRKPR6PX6r1+/OhyOgYGBHLP19fXdvHmzvLw8Go0mvaVYUlLS1dV1+fJlj8fz/v17g8Fw6tQpZmi97zNmSJXO3NzcoUOHXr58ubS05PF4TCbT3r17c8mpUChomp6ZmamoqNBqtcPDw1++fDGZTEn59Xq91+tlAjs6OtIlZBrVhw8fUn9Tp1AoKIpyOBwZikm3UOxYAIDiyLxdk2HfPulwcnJSo9GIRCKVSqXX65nvFxYW2tvbxWLx7t27jUYje4s7aXuZ/U1qhezRcDis0+kUCoVarTYYDCsrK0kTcq85a6qkhDRNGwyGnTt3CgQCpVLZ3d3t9/tzKS8ej+v1+vPnz8fj8dnZ2ZaWFqlUOjg4mLQgw8PDSqVSKpWePn068SOFNRMODAyUl5ePjo6mVmswGJihNWMzLFRSLABA4TbQe/6b3urqaklJyZpDeMceADalDfSe/6aXrsEAAGxW6DEAAMAV9BgAAOAK9mMAAIAruI8BAACuoMcAAABX0GMAAIAr6DEAAMAV9BgAAOAKegwAAHAFPQYAALiCHgMAAFxBjwEAAK6gxwAAAFf+AvMsqujGiGe1AAAAAElFTkSuQmCC)

Screenshot: softeng.polito.it  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 8 October, 2019 09:10 GMT
Vulnerability Verified: 8 October, 2019 09:16 GMT
Website Operator Notified: 8 October, 2019 09:16 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 8 October, 2019 09:16 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 6 January, 2020 09:10 GMT