Lucene search

K
openbugbountyGh05tPTOBB:1007980
HistoryNov 04, 2019 - 9:14 p.m.

spojenisbohem.cz Cross Site Scripting vulnerability

2019-11-0421:14:00
Gh05tPT
www.openbugbounty.org
6

Open Bug Bounty ID: OBB-1007980

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: spojenisbohem.cz
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: Gh05tPT
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAWEUlEQVR4nO2dfUxT1//HK1YstbiKpfJQsVTTYeMYEkPQOUPIshBCWOOUsY4pMuKQMGSEMSDOMSQVGRrnNmMMM5iYzSyGGGKMM24hHTEOkVTGWNdgV7F2HStYWGUVKvf3x/nt5Hzvw+ntEw/uvP7quffccz+f93349J5z7+csoShKQCAQCARCGIiYbwMIBAKB8MxCYgyBQCAQwgWJMQQCgUAIFyTGEAgEAiFckBhDIBAIhHBBYgyBQCAQwsWCiDHJycl3797lKhLCB5E63BCFCf9x5j/G/Pzzz7Ozsy+++CJrkRA+iNThhihMIPiIMffv34+OjmZdNTExcfToUa4if7q6uvLz87mKQYKxP5it/G02MDPCDSr1+++/HxUVdf78ea7KAR9fGgFI8ejRo3379sXGxiYmJn744YczMzNgefhshkbev39/1apVAbQAgAr//fffBw8eXLduXVRU1PPPP3/s2LGnT5/CaufPn9+4cWNUVNTGjRs///xz1IwlCGvXrq2vrwfu02REay5dujQ5OfnIkSNgF0vYCNgjuLvAzueQ60AzJqw6LMyreBFAYbFarRKJhM8qTE08GRkZ169f5yoGj8fjCflW/jobsDhhBUrtdDojIiKMRqPX6+WqHCoXAmgnPz9fp9PZbDaTybR9+/a6ujoqzDbDDa1Wq1QqDaAFAFR4165dWq3WZDKNjo7euHEjKyurt7cX1Dl79qxCobhy5YrT6ezu7t6wYUNTUxNqhsfj8Xg8U1NTAwMDmZmZhw4dYrpGq2k0GjMyMkA7YKHJZJJKpZ5/CdgjdHcBbBhyHWjGhFWHhXkVL3zmOcbY7XapVDo9Pc1aXLA8AzEGlZqPefMVY6amphQKhdvtBsXe3t4NGzbwbCdgm202W3p6OviRkZERQAsUovDU1JRQKHS5XKzVFAoF+qeqv79fLBYDf5n29/T0pKSkMFex1tRoNGiFYIIljcCEDYcOFFuModUMlQ4L8CpeFPAaj/nss8+Sk5NXr1799ttvT0xMCASCiYkJpVLpdruXLFly/vx5tHjixIno6OhPP/10zZo1q1at2rt37z///MPVcldX16uvvrps2TJm8fbt2y+//HJ0dHRiYuLrr7/+66+/gmdV1pYfP3787rvvxsbGrl279pNPPoEP4PDx9smTJ++88050dPS6des+/vhjUAGsPX78eHJy8qpVq9566y3gHe2hmGkJWH7s2DH+lrDKyMewFStWvPHGG2NjYx988EFsbOzq1av37dv3+PFjpphPnz6tr69fs2bNihUrdu/ePTY2JmB0ETCVHxsbQw8lqwu0w413E1We6zRgSsFVPyoq6sGDBytWrAAbDg8PJyQk0GxmNSYAmyGJiYl37twBP3766Sew8LvvvuOqz1oBKjw7OysQCIRCIXOTiYkJm82WlZUFl2zevLm7u5trFyKRyOPx4M2ANb1eL39rA4ZPO6DOItLh9u3bW7dujYqKio2N3b1798OHD5l1MFfu0aNHY2Nj4+Pjv/rqKz5GPuPgQ5DVahUIBMXFxXa7fXh4ODs7u6ysDKwymUzgsRR0VsCixWIRCAS7du0aGRkZHh7etGlTY2MjV/u5ubkXLlxgLcrl8vb29vHxcYvFcuLECYvFAoxhbbmkpCQvL29kZGRwcDA9Pf3UqVPQfvDXo6GhobCw0GKxDA0NZWVlffHFF9C7PXv22O12s9m8ffv28vJyivGHJXhLMDJiDCsqKrLZbMAwmUwGNjebzVlZWZWVlUwx9Xr9li1bBgYGbDZbZWWlwWCg/u0i8Hg8tbW1hYWFrFLTDiWrC3zqMM8cpkRcUmAkhZhMpoSEBNC7gtrDZQxPm2UMWM/VuLi47Ozsvr4+5qre3t7s7Oy4uDh0Iapwfn5+Xl5eT08PfCAD2Gw2kUjEujuKcR66XK68vDzWU5RWHB0dzcnJqa2tRSvQ/r9j3PEJujt8OzRlQq4DhX2OCViHM2fOnDt3zuVyORyOqqoqrVbLbBx/S3E4HNeuXTOZTFxO/XfgFWMmJydB8ebNmyqVCq5iPcvBJiMjI2B5Z2fnli1bwO+RkRGlUgk3cbvdEolkfHycWRwfHxcKhbQOU66WvV6vRCKxWCxgeVdXV2ZmJs0qmUwGT2vQS8v0rqenB3iHuhYSSzAyYgyDvQo9PT0RERFTU1Nwc9BfREMul/f39zOXUxQ1ODiYlJTkdDpZlUf9xbjgsw4fibikwJw2AJvNplKpLl68SLOZz9HHV7MxYNXQ7Xbr9fqYmJiCggKz2QwWms3mgoKCmJgYvV6P3jdpCk9OTtbV1anVaqFQuGHDhsbGRhD28N0vQBMY+SIjI3U6HWv3EVozJiZGJBKVlZWhJy3z3srqDk/QvXO1w6pMyHWgGDEm5DoMDw+DGEkzEnPlwuNOoPwdj0GPECbGoH9JhoaG5HI5+O31eu12O1zV2dmZnZ3NVSwsLExLS6uurm5ra+vu7sa0bLfbIyMj4XKz2Qz/NwGrxsfH0XM0JiYGbMjlHW158JZw7chfw1iLAJfLJRQKuQbAt23bdvnyZS6p0d3xcQEjONomq0QYzblOG0BmZib6tATb8Xn0+dvMh/Hxca1WKxQKQVEoFGq1WuYYA01hiMfjuXnzJhyy9vn/XSwWg7DX0dERFxcH/2cwZYQ17XY78zTgGoegucN8mGN9vGOGBFo7GGVCqwPNmFDp0N/f/8orryQkJICrknlb4HnlEiie4zGhYunSpfHx8bCIf2v5m2++aW9vT01NnZ6erq6ufu+99wLer8fjiYiI6OvrMxqNRqNxYGDAaDTy3zyEloTWMCZLly5lLvzyyy9VKtVrr70Gl4T2BfE54I8//hgYGAih8iixDLhq3rt3r6KiwmAwNDU1gSVNTU0Gg6G8vPzevXtoTS6Fly9fvnXr1lOnTn377bcCgQB05cHXcAF37tyB420RERGJiYmJiYl79+6VyWTt7e1ctsGa8fHxrKcBH3eMCFxL+LQj4FZmUeig1Wp37NhhMBiMRuPVq1eZm4T8yn2WwYegwJ5jBEinx+XLl2mdHgCv1yuTyWDfBa1Iw2g0KhQKrpb59JZIJBJmPxLP55jgLcHI6JdhrEWIXC43Go20hTabLSUlBX14Z0o9B31lUCKM5pjTxuv10s6Nue8rKysrk0gk1dXVsMsR4HQ6q6qqJBIJHGNjKkwbfjAYDLCzVKFQ3LhxA64aHBzkep/q4sWLCoUC9Pz4fK+MBvOc4XLHXzDtMJUJuQ4U4zkmeB1GR0fRBzKj0ch6W+Bz5RKoYPrK3G63UCiEPZiwCAdvbTbb4OBgWloaOngLzwyDwbBp0ya4nFYcGhrKycn54YcfnE7nyMhIaWlpXl4epuXS0tL8/HzMmH9ZWVlmZubg4KDdbm9tbQWvzPOJMSGxBCOjX4Yxi2hfs16vz8jIAGP+4H8ZRVE7d+68dOkS+kEATWrm7lhdoB1uLsHRK59VInyM4TptKMYXS2g7XMbwtJknRUVFVquVa63Vai0qKgK/aQqbTCa5XH727Fm73e5yucBavV4P1qLfhRgMBo1G09zczPQRoNFozpw5w1wVwL0V745P4OHw2Q5UJhw6UEHHGFb75XL56dOnXS6X2WzWarVgk8nJSaFQaDKZQBccnyuXQAUTYyiKamxsFIvFHR0daPH48eMSiaSlpUUul0ul0j179rB2ItfU1DQ0NMCmaMXp6enGxka1Wh0ZGSmXy4uKihwOB9ictWW3271//36ZTKZQKOBAIrpHj8dTVVWlUCjEYnFubi74j8knxmAsaW1t5WkJRka/DMPYSVGU1+utra2VyWQikUir1YL/ZczHVprUzHa4xEQPt083uQ4WXnPWg8tUgNYOl8F8bA4HTIWvXr2alZW1cuVKsVicmpp69uxZdG1HR0dKSopIJFKr1axjTpALFy4olcrp6engY0wwBHwnDbkOVNAxhhWDwbBlyxaRSBQXF1ddXQ03qaurg6cTnyuXQPmMMQHAU2W1Wn3r1i2uYjAtB7nJMw8fqYPHX+WfpSM1NwoTCIsClu+h5obffvsNUySEDyJ1uCEKEwgQ/94ru3v37oEDB8JkSsiZmZm5efOmQqGYb0Pmh8V1sAg0ZmZm3nzzzT///JP2mw9kQgHCwsG/GFNcXKxUKsNjSejZv39/RUWFXq+fb0Pmh8V1sAg0li1bFhkZWVNTQ/vtEzKhAGFh4bM3zeVygXc/QKZb+D7J5ORkZWVlUlISGKNraWmBg6hwE1ZC2/NeVVUlEongewehBQ5CpqSkMN9VC0fjPPE5dIkeLPDKFgqabcHj8RQWFmI8Yq3gdDqLiopkMllCQkJdXR0tjWlOTg587YcLWh2LxZKfny+VSuVyeWlpKe3bPaYLOTk5YJXJZMrJyVm5cqVcLi8pKWH96I/LR4zvk5OTcXFxrLlAuEzFa+LTR6Ym/f398ENR9Dee5ubmiooKCnuFUtynH01qhUKB+kIbYIfVIiIilEplU1MT2EVgtxrCM4nvA49++IJejZg03T7vwsFnFwfwSfAeMFzJxkMSYzCZzPngM8YwX7aBry83Nzfn5+eDVR6PJysra9euXVwecVXIzc2F+fbRROvUv6+oom+FMWHW0Wg0tbW1DofDYrFotVqdTsd0x4MA73oqlaq0tNRut9tsNp1Oh+Zkw7uA9725ubmmpobVeC5TMZrw8ZGpiV9vTEHCN6EAq0lzNqEAYZESYIzBp+mes3eEwrojrmTjIdkpJpM5H/yKMQ6HA/7rpyhKo9F0dnbCas3NzRiPWCu43e6IiAg0nZparYZry8vLmbdXGrQ6zK/eFAoFlzsoHo/n5MmTMPvZwMAAbUOMjxjfJycnN23aBJtF4TIVrwkfH5m6BRBjwjqhgE+TwjqhAGGR4iPGuFwu+KgLPnwBy8HXbaz3RHSTjo4OcCLq9XqZTBYXF9fe3s48Tdva2pRKpVQq1el08Kqw2+25ubkSiUSpVLa1tTFPVqfTSbMN3QuF/YYD7FEsFhcUFDidzpqaGpB0qLi4GDgFvKB1d/T29sIYc/LkSaVSGRMTU1RUhF7Jvb29mZmZIpFIJpOBLwqZCmAah/IyLbfZbK+++qpEIlGr1Xq9Hv3CpqSkRCKRJCUlHT58GJ9ksLe3VyaT0XbN56sCzNcY6K3E5XLFxMQ4HA5Ma6x1NBoNyFw7NTVVVlZGexyxWq1isbiyslIul8vl8qqqKuaT6/T0dG1t7Z49e/i4gF+u1+sxva+spuI/afLpI6smPGPMtWvX4O8zZ84UFBRQPK5QrtOPuaO+vj7YuYo3qa+vD42sTBFQUwn/EXw/x6BJ+9FTiitNN/W/OdWtjGTXzC5dZnZ9iqJ27typ1WodDsfw8HBqairrHyLahAK0lNqYNPs+0+ZjkvRZuRP1U2xZwZkK4DMAclmu1WrR1PdQEK4c46y3pPLycua8ACGMMW1tbVx3eQhrHYvFsnLlSpFIJBQKU1JSaCcV0LChoWF0dBS439bWhlbo7OwUCoVZWVlcfTL8Y4zb7ZbJZCqVKiEhoaGhgRnMWE3lE2MwPrJq4jPGMOcUCOuEAniTwj2hAGGREvh4DFeabopxIgr+N9k1cy0zu77X6xWJRDDjU2dnJ2uMQW2j7QWfZt9n2nx895GAI1E/DZAVHK8AE1bLgSBo6nsoCFeOcdYhbqlUGkCSJf4xRqVSGY1GfCcJa53Kysr09PTe3t7r168rFArwJIpajn7VePnyZdr0lFNTUyA3Cde7BvxjTFtbG8iSAIIZ83UMVlP5xBiMj6yaYG7orJnzwz2hANMkwRxOKEBYpAQeYyC0NN0U9trAr4UnJS0T+9DQkM8YQ9uLv2n2aUX8cwymBWZWcKZt+D+SrJbb7XZa6nu/ZgcAXLx4MTU11adHfFxmVQAmtMfEGNY609PTYrF4YGAAFL/++mvWPKoQk8nE+pLV1atXwRzJPl3ALFer1TCWd3V10SzhMtVnjMH4yKUb5kphzZwf7gkFmCaFJJE+4dkmBLn9aWm6nw0kvpKNc+EzK3gwjTPxK8d4R0dHSUmJv7vgz6lTp6qqqgKoMz4+Pj09/cILL4BiWlqazWbDtwMm7p2Zmbl9+zZcqFKp7Ha733YjPHr0yGKxrF27FhTVajWtwQBM9bkhH91osGbOX6QTChCebQKPMbQbIhh9Cdqe/0cul0dERNy/fx8UTSZTAC1ERkb+/vvvsAW/Pkh87rnnFAqFwWCAS3755ZcdO3bgt/rrr7/sdvtHH320fv36xMREkUgUQOOslsvlcoFA8ODBA7DQbDaDH/Hx8WKxeHx8PPFf0Bl6UB4+fNjd3a3T6Xz67hOZTDY1NTUxMQGKNpsNmNfd3V1cXBwbG5uenj45Ock6FwtrnTVr1giFQni7ZB6s77//fvPmzbA4NDQEKszOzm7btu3Ro0dgudlsTkpKCsY1sVg8OzuLik9rkMtULk18bijgpxuN+vp6s9ksl8vT0tJANoenT59euXIFjTFcV6hf5/ahQ4daW1ufPHmCt4cnBw4cSEtLi4uLM5vN9fX1IWmTsNDx+aQDE6SPjIzAR2x8mm40p3pgfWXUv2/3W63WwcFBdMyf1uGL6cfzN80+rciVbBzfAjMrOKttmEzmXJaDMX+Y+h4/OwB6sAAtLS1gWnIm/vaVURSVk5NTVFQE39SAnTCAW7durVy5knUuFq46FRUV2dnZFoulv79frVbTXutyuVwymezw4cNOp7O/vx8dJsnLyyssLLTZbEajUaPRnD592i8fmcu1Wm1OTo7Vah0YGNBoNOfOnaNtwmUqqyZ8NuTSZHh4GB5l9DfNfpA5fw4mFKCwFy+rbaGdUICwGOH18S1IkN7e3i4SieBIHT5NN8ypHnCMcTgceXl54N3llpYW1mz2+Bjjb5p9ZpE12Ti+BWZWcK5LkSuTOZfl6LvL6MvcrDnGPR4PerAoikpJSUGnW0bxeeNgLhwdHdXpdDExMazftKOaYG7uqG4ej6eiokIulyclJYF3xmgb9vX1bd++XSKRqFSq1tZW1JLCwkKpVKpQKDA3Sv4xxul0AteSkpJaWlqYdZimYjRBt+XakEuTS5cuwfEz9DcrczChABV0jCH8B/EvwUNlZSXroGK4AX/K5n6/i5rADpbPG8ecNRiMJaH1Yl4s8Xg8SqUSvHuG/uaCTChAWJj4l9u/ra1tXqatNhqNKpVq7ve7qAn4YIU8k2bADQZjSWi9mHtLli9ffuHChZdeeon2mwsyoQBhYbKE4khgN+8cOXIkISEhPz/fYrHodLrDhw/v3bt3vo169hkbG3O5XOvXr5/3BoOxJLReLBxLCIRFx8KNMT/++GNVVdXg4GBSUlJFRcXBgwfn2yICgUAg+MfCjTEEAoFAWOyE4BtMAoFAIBBYITGGQCAQCOGCxBgCgUAghAsSYwgEAoEQLkiMIRAIBEK4IDGGQCAQCOGCxBgCgUAghAsSYwgEAoEQLkiMIRAIBEK4IDGGQCAQCOGCxBgCgUAghAsSYwgEAoEQLkiMIRAIBEK4IDGGQCAQCOGCxBgCgUAghIv/A/ab0szgXu4NAAAAAElFTkSuQmCC)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAUCklEQVR4nO2df0xTVxvHa61YKrCK7bVARUBWkDCHxjnciCHEuIYR0ixOGWOozGxIGDLjHBK3OWTIGCaOLYQ4NbgQY5aFGGKYM9OQhhhEbCpjpNbKCtbKELBgZVdE7vvHyU7ue3/1tlAEfD5/3Xv6nHOe8z3n3qf33B9nAUVREgAAAADwA9Ln7QAAAAAwb4EYAwAAAPgLiDEAAACAv4AYAwAAAPgLiDEAAACAv4AYAwAAAPgLL2JMdHT0zZs3/efKCw7ICzC4efPmnj17nrcXgCigs/gQG2P+/PPPycnJV1991a/evLCAvACbnTt3RkVFPW8vAFFAZ/EhNsY0NTVlZmai7U8//TQwMPDMmTN8xiMjI0ePHp2iZ729vcHBwV5lefjw4a5du9RqdURExOeff/706VOU7tFhia8+Yyd7e3uXLl3qbXYMlvfRo0d79+5duXJlYGBgXFzct99+++zZM2x25syZ1atXBwYGrl69+ocffqC7sYDGihUrDh48iJtPV5JuuXDhwujo6CNHjqAqFnDhc4vYVXuLgBR8OkgEpRCpg2TKUvjcavogHBoa6uzsLC4u9qiG8NCdShcwEHMcTQXObp0u/wXGjEc8Ht30zmKMwAULFkRHR0/J9bkOJY4NGzZcunSJoqjBwUGpVGo2mycmJviM7XZ7UFCQyJKnsZDMzMzs7GyHw2GxWFJSUkpKSkQ67Ft19Fx2u12pVHqbHYPl3bp1q8FgsFgsAwMDf/zxR2pqant7O7I5ceKEVqu9cOHC4OBgS0tLbGxsWVkZ3Q2SJEmSHBsb6+zsTE5OPnToELtpDEuz2bxhwwZUDkq0WCxKpZL8D59bxK7aW/ikENCB3UC6FCJ1oKYshc+tZnvoUQ0x1U29HynRx5HP8HXrtJxMhMeMRzwe3XxDiyTJ8vLyzMzMKXk/xxEVY5xOp1KpHB8fp8R1+XOJMWNjY1qt1u12o9329vbY2Fjx5fjms8PhWLduHdrYsGGDt9kRWN6xsTGZTOZyuTjNtFotikMIk8mkUChQe9nOt7a2xsfHo22BMxeyTEhIwLtTDJYMfB4JAlII6MBZI5bCKx2oKUgx7TFGeGBMy+HmlW/+gK9bp6Ve4THjEa9iTH9/v16vxz8lJCQ0NjZ67/L8QdRcWVNT05YtWxYtWjQ0NBQVFeV2uxcsWHDmzJnHjx9//PHHarV6xYoVX3/9Nbp4HxkZodtIJBJOMwy6Fv7uu++WL1++dOnSHTt2/Pvvv/jX77//Pjo6etmyZR988MHIyIiAfWBg4N27d5csWYIy2my28PBwhsN8zjB8FnaYTkRExI0bN9DGtWvXcPrvv/8uLCndAMs7OTkpkUhkMhnbfmRkxOFwpKam4pS1a9e2tLTwlS+Xy0mSFPYBW05MTIh0dYqIl4VPCm91kIiWwmcdrl+/vnHjxsDAQLVa/e677967d49t8+TJkw8//DA4OHjlypVfffXVs2fP0DA+evSoWq0OCws7deoU+8DBCA8Mei52sfTp3ODg4GPHjkVHRy9duvT9999HBxTi/v37b7/9dnBwcHR09LFjxxhTQ4zjiF2LhOfIole6ZMmS7du3Dw0NffbZZ2q1etmyZbt27Xr8+LFERLeyzwN8ynMKK1A438F+7969t956Kzg4OC4u7uzZswJdyeiR5cuX//bbb9jDgYGBjIwMdse9QIgJROnp6Q0NDWjbYrGgK8GJiYm8vLyMjIy+vr6urq5169bV1NSwbSiK4jND2O12iUSydevWvr4+m82WmJh4+PBhnL5z506n02mz2dLS0vLz8wXs6VgslvDwcDSZINIZMe1SseBTTKPRpKWldXR0sH9qb29PS0vTaDSc8mZmZmZkZLS2tjL+ZDkcDrlczlcd47+ey+XKyMgoKChg/8qwHBgY0Ov1Bw4coBfF+Msm0BaPMKrzShZOKYR1YNdIl8IrHSiWFHzO19XVnT592uVy9ff3FxcXGwwG9l/v0tLSrKysnp6e7u7u1NTUH3/8EQ3j3Nzc/v7+ixcvWiwW6v8HIaMQvoHBzsUolj6di35yOp1WqzUlJQWPEIqi3nnnHYPB0N/fb7PZ1qxZw/7bLlwLxXNkIcucnByHw4EqValU6KC2Wq2pqalFRUWUYLfynQc4lac3E/smPGb4DnaDwUA/yWBB2F1J8V/kFRQUoAa+yHiOMW63OygoaHh4GO1iNScmJoKCgnp6elB6U1NTcnIyw0bYDBtLJJK+vj6029jYuH79epw+OjqK0q9evRoTEyNgj3E4HDExMefOnfPKGTHtcrAQEK2ioiI0NHTbtm1WqxUlWq3Wbdu2hYaGVlRU4DMFQ97R0dGSkhKdTieTyWJjYw8fPoxCo/CMAdIER76AgIDs7GzO6SO6ZWhoqFwuz8/Pp8/Xs2MMZ1tEwnBbvCx8UnicORGQwisd2FKI0cFms2k0GraTKpUKNw3d+0EO4H5ny8UohG9gcLaLXiwjxuADqrW1FR1QFEVNTEzI5XI85hsbG9kxRrgWvqMGWeJZvtbWVqlUOjY2hnavXr3qcUKb7zzAACkvrAAbPreRIPSTDBaE3ZV8VZAkqVQqTSYTZ9UvDp5jTGNjY1paGt7FajqdzoCAAJxutVrxn1C64gJm2Jj+L6O7u5sgCIrVbfiA57PHJCcn0y+VRDojpl3eMjw8bDAYZDIZ2pXJZAaDgTGrzpAXQ5Lk1atX8f1qj9cxCoUChb36+nqNRoMPY4p1dsCWTqeTff+Wb+qZ0RbOizl2IuexJ0YWPinEXMfwSeGVDnxSMJynKMpkMm3evDk8PByFK6VSyWj18PAwPeyFhoYSBMGpjPAdI7YaYnLRYwznAUWxxnx3d7fHGMOohe+oEaiUvit8HcNXAlt5Tt8ECudz2+l0Mk4yqHDOruSslKKoc+fOrVmzhrPeFwrP92PoTy3Pfu7fv9/Z2fnJJ5/4o3A1CwHjO3fuFBYWGo3GsrIylFJWVmY0GgsKCu7cuYPN+ORdvHjxxo0ba2pqfvnlF4lEgqYp8OPIiBs3bqDpbIlEIpVKIyIiIiIiduzYoVKpTp48yecYtgwLC1u4cKGYhrPbYqaBzTgTPRbFKQufFB51kIiWYlp0kEgkBoNh06ZNRqPRbDY3Nzezc5EkKZVKOzo6kDKdnZ0C+niEMTDmB2K6lY1H5adSOCdedWV9fX1eXp63Vcw/PMSYZ8+eXbhwgfMkSBBEQEDA33//jXYtFgvnK0hizEiSvHv3Ltq2Wq2RkZHCXgnYEwTR1dXFl1GMMwI2ZhZ8Fe3ZsycpKUmj0Vit1oMHD6LEgwcPWq1WgiCSkpLQK8FseRnjHk1/SySSl156SavVGo1G/NNff/21adMmztoPHTpUVVX15MkTPve8grMtETSwJTtx5cqVjx49Ei6KLQuCUwqvdJBMqxSczj948MDpdH7xxRerVq2KiIiQy+XsjGFhYQqFYnh4GIsTFhbmbe18A2NaIAhCKpX29vaiXYvF4kMJYs4GfHjbrRJxynssnM9tgiAkEgn9JIM2xHflvXv3WlpasrOzPTd+3iN8mWM0GhMTE+kp9KvC3bt3Z2Zmsm+Xud1umUyG56w5zfDcN76H73A4urq6kpKS8D1/vrkyTnsMe1adXo4Yn/lsxJOTk2O32/l+tdvtOTk5FEtei8VCEMSJEyecTqfL5UK/VlRUoF/pz/gbjcaEhITy8nLONlIUlZCQUFdXx/5VzP0MxjyJcFs8Qu8OkbJQglII6EAJSuGVDhRLCj7nCYKora11uVxWq9VgMCiVytHRUZlMZrFY8BRcfn5+cnJyV1eX0+msqqoqKyvjdIA+CPv6+vB0jfDAoOfyba6M+u/9G7vd3tXVRb/nTz9OhdXjPGpEzpVR/N0qUAJbeT7fBMYM38GO7vnjkwyulN2VjM5CVFZWomcQAA8xZv/+/aWlpfQUehe63e6PPvpIpVJptVr6TUiKog4fPqxQKOrr6znN2OO1srKSIAilUpmbm4sm0AViDKc9w4zTYZE+C9hML2x5m5ubU1NTQ0JCFArFmjVrTpw4Qf+1vr4+Pj5eLpfrdDq+e06IhoaGqKgo9itNPsSYqSDmVM6HgBR8OnDWiKWYYozhw2g0rl+/Xi6XazSaffv2oSwlJSV4/FMURZJkcXGxVqtVKBTp6ek9PT18DuBBSJKkXC7Hf9SEBwbO5XOM6e/vz8jICAoKioqKqqysZJ+vParHedSIjzEUT7cKlMCpPJ+wfGOG72B3OBxbtmwJCgrS6XTV1dX0oMvoSpRI7yyKouLj48+fP8924wVkAUVRAlc5cXFxP//88+uvv+6/C6ne3t7ExET6jMr02s9mZkBeYO6yd+/erq6uy5cvz3C9t27d2rRp0z///DPD9c5pnldnzX443uqic+vWrZnx48UE5AUEqK6unsrTAT5jNptjYmJmvt45zfPqrNkPrB8zh3n69Ol7772H/m/St8UASwnMfhYtWvTaa6/NTF1Hjhw5derUgwcPrl27Vlpamp+fPzP1zhtmsrPmFhBj5jCLFi0KCAjYv38/Y9sjsJQAwCA1NbW2tlar1ebk5BQVFe3YseN5ewTMF8TctCFJMisrS+AeKafB4OBgTk6OSqUKDw8vKSlB958xer0eP/jEB8Omp6cnMzNTqVQSBLF7927GW3voeTM6+Mt0FotFr9eHhIQQBJGXl8f5uh9fGwXaPjo6qtFo0Ic0GPC5KqyJxzayNTGZTPgVUfq2MOXl5YWFhagJRUVFkZGR6F5oZWUl/QEHfJs0Pj6e8YgBXWetVktvC/uFcIRUKo2KiiorK0NV+DwaAQCYQ3i+jnny5Ilerxd4GJ/PIDc3d3Jy0mw2X7lypaWlhf7a2q1bt0wmU25urkC9bJuMjIz4+HiLxdLW1jY4OFhQUMDIEkT7pDZJkk1NTSg9PT1dq9VaLBaTyUSSJHsegK8Jwm2vqanJycmJi4tj/8TnqoAmYtrI1iQ0NNTtdrO3hcEvfubl5fX19V26dKmvr6+2tvbixYsmkwnZ/PTTT4cOHaqurnY4HHV1dTU1NUeOHMElBNE+jN/c3MzZFoal2+0+f/78hQsXKioqJBIJ5/fzxTgPAMBcwmMUstvt5eXlwh8UYhu43W6pVEr/TpFOp8O/FhQU4C9h8MGwGRgYoH/Aw2w2a7Vahht83944fvw4/t5RZ2cnI6NAGwXaPjo6mpiYiIulw+eqsCZi2sjWzdvncal5vZQAAACzDbGzE2Leq2A8xs73VLvL5QoNDe3v7xcojdMmISEBfeV0bGwsPz8/KyuL4YBCoSgqKiIIgiCI4uJi9nst4+PjBw4cyM3N9aqNnOkVFRX47Qc2nK4KvyvgsY2cmoiMMRcvXsTbdXV127Zto/57d49zFQ2XyyWRSBhTee3t7XwxpqOjIyoqSoxLHR0d9MjKFoHuKgAAc53nEGOqq6v5zvIYTpuenp6QkBC5XC6TyeLj4xknRzT1X1paOjAwgD7HXV1dTTdobGyUyWSpqal8ywKKjzFut1ulUsXExISHh5eWlrKDGaerYmKMQBs5NfEYY16opQQAAJhtPIfnympra/ft2ye8RDanzfHjx2NjY41GY3Nzs9vtPnfuHD2LRqNpa2v75ptv1Gr1qlWrysvLGR8N1Ov1V65cGRwcrK+vn2IT6urqUlJS2tvbjUZjU1NTbW0tw0DYVQEEMorRjc7t27e3b9+u1+s3b95ss9lQ4uPHj41GY3p6OtptaGhITEzMy8tTKpUvv/wyXqNpYmKCc0UsjNvtxh8GJQgiJCSkqqpK2HLZsmWRkZHotr9AyTabbfPmzVu2bNm+ffvt27fFtBQAgNmLyFg0Xdcx+FP2AhPxnDbj4+MKhaKzsxPtnj17lrFsDAOLxcL5kFVzczNaHdljEwTSdTodXluiqamJ4Qmfqx6vYwTayKebwEXDfFpKAACAOcpMX8fU1NQUFxf7YDM8PDw+Pv7KK6+g3aSkJIfDIVwOWqH26dOn169fx4kxMTFOp9Nrv2k8fPiwp6dnxYoVaFen0zEK9MFVjxnF6MZgPi0lAADAHMVfMUalUo2NjeGVtx0OB/pcdktLy86dO9Vq9bp160ZHRzlXYeG0Wb58uUwmw6dL9sfDL1++vHbtWrzb3d2NDCYnJ994442HDx+idDFrBwijUCgmJyfp3wNnFMjnKp8mHjNKxOnGYD4tJQAAwFxF5PWOt3NlFEXp9fqcnBy8eDiehEG0tbWFhIRwrljMZ1NYWJiWltbT02MymXQ6HeOxLpfLpVKpvvzyy8HBQZPJlJiYiF8bzMjIyMrKcjgcZrM5ISGhtrbWqzay0w0Gg16vt9vtnZ2dCQkJp0+fZmThc5VTEzEZ+TSx2Wx4rom+zfD/xVlKAACAWYUvMYbzxMFOHBgYyM7ODg0N5XynnX5yETi5009AJEkWFhYSBBEZGYmeGWNk7OjoSElJCQoKiomJqaqqonuSlZWlVCq1Wi3nohQe3WB/wgA1LTIysrKykm3DdlVAE3pevox8mvz66694PVf6NifzfikBAABmG758vWMqi4JMb4Ezn9EfBfqclyTJqKiokydPMrb50Ol0bW1tvjkJAADgAx6+7c+HVwup+rXAmc/ojwJ9y7t48eKGhoY333yTsc0HLCUAAMAM42GNMk6GhoZcLteqVaumywmfC5z5jP4ocNqdAQAAmCX4EmMAAAAAQAywfgwAAADgLyDGAAAAAP4CYgwAAADgLyDGAAAAAP4CYgwAAADgLyDGAAAAAP4CYgwAAADgLyDGAAAAAP4CYgwAAADgLyDGAAAAAP4CYgwAAADgLyDGAAAAAP4CYgwAAADgLyDGAAAAAP4CYgwAAADgLyDGAAAAAP7ifzZOxDBaEAc0AAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAJkUlEQVR4nO3cbUhTbR8A8GtzeJ+95aabL8uaVqhUWJHEDCspCJMFUmlRw95khVjZoYYJ0SpI7Q0xKekF6lP0JaQPYiEWaaJma9l8aUptU6eVWy3nOo6583w493Oew5xr7nYFz/3/ffJc53o/4H/nf87GIkkSAQAAAGHA/tMTAAAA8H8LYgwAAIBwgRgDAAAgXCDGAAAACBeIMQAAAMIFYgwAAIBwgRgDAAAgXCDGAAAACJdfxBiz2SwUCn/Zy8mTJ7lc7oMHDwLU+fr1a35+vlgsZrFYLBYrISHhxIkTU1NT1NmJiYkTJ07I5XIul5uamlpVVTU9PR38Mv4Is9nMYrHev3/vU/7o0SOxWBxChw6Ho6KiYq6tWP5s27atqqqKWe3p06cLFy4MYVYAABCyX8QYuVw+Pj4euI7NZqupqWlvb1epVAGqqdVqt9ut1+sJgiAI4sWLFwaDobKykjp76NAhi8Xy7Nkzi8Vy8+bNxsZGnU43p5X8KdevX/cpqa6uDq2r79+/X7p0aa6tqP3s7+8XiUTEf+3YsaO+vp5Zrb6+Pi8vL7SJAQBAiMh/zGQyCQSCwHXcbjeHw/ny5QuzsL29PT09nSRJl8vF4XC+f//+zyfzO5lMJg6Hw+PxrFYrXdjW1oZhmEgkCq3DX+5kgLbMQcfGxjgcztjYGF0ik8mamppC6xwAAEITbK6M+uPatWvJyclisXjfvn0OhwMhZLPZkpKSnE4ni8WicmWTk5NHjhyRSqWLFi06f/48lfIaGxuLjIyUSqUIoY6OjqVLl4rF4oaGhuHhYYSQ1+tFCHE4nAAToA+pNBRVfuXKlbi4OLFYvH///p8/f9LlFRUVUqk0ISHh3r17CKGpqanDhw8LhUK5XH7u3DlqSswV8fn83bt322y206dPS6XSmJiYgwcPTk5OUoP6bU7BMEypVNbW1tIl1dXVe/fupQ9fv36dmZnJ5XKlUml+fv7IyAhVuGHDBqFQuHDhwp07d/b19SGEHA6Hz07OHNfv6vyKi4tTKBT0rUxHRwdBENnZ2T7Vpqenz5w5ExcXx+fz8/PzbTbbbFcw+O0CAADaHJ75O53O7u7utra2zs5Oi8VSXl6OEIqJienv7xcIBARBULmy48ePW61WnU7X2Nj45MmTmzdvIoS8Xi+b/fdYJSUlBQUFRqNRp9NR0YXP5+fm5u7Zs+fVq1fB/6tyOp2dnZ1dXV1dXV06ne7y5ct0eX9/v8FguH//flZWFkLowoULLperu7u7sbHx5cuXdXV1dE29Xt/a2qrX661Wa1pa2vj4eHd3d3t7u8lkohYYoDnl1KlTdXV1VIQbGhpqbGwsLi6mz+p0OrVaPTY2ZjAYEhMTS0pKEEJKpfLAgQMWi6W1tTUrKwvDMIRQVFSUz076HXfm6mbDTJfV19crlcqIiAifOpcvX25qampqajIajTKZrLe3d7YrGPx2AQDA/wS+zaGzNyaTCSH048cPqry1tXXJkiU+dUiS9Hg8AoHg48eP1OGTJ08UCgWzjsvlYrPZ4+PjJEk2NzfT6Z0fP36UlZWlpKRwOJxly5ZptVqPx0POSB/RGSFqPhaLhSp//PhxRkYGXW6325mrkEgkTqeT+luv169bt46uSSfoWltb2Wy2y+WiDtva2pYtWxagOXNuGzdurK2tJUlSo9Go1WqftBVtcHAwPj7ebrdzOByCIALs9mzj+l2dz84wSzAMoy5ZWlpafX39zFaxsbE6nY5ZEuAKBrldAABA85Oemo1AIKDTVomJiXa7fWadL1++uN3u5ORk6jAtLY3630Sz2+2RkZExMTFUJ3Q5lQKqqKiYmprS6XQ4jns8nosXLwaYD4ZhixYtogeyWCz0PJmvdX379m18fDwpKYk69Hq9dFJOIBBERUXRK1qwYAGXy6UOZTIZ9bJDgOa0U6dO4TheWFh49+7dtrY25qm3b99qNJre3l632+31er1er1gs3rVrl0Kh2Lx5s0wmy8jI2LRp08zVzTauz+oCkMvlaWlpDQ0Nq1evHh4e3rp1q08Fh8Nht9vT09OZhQGuYDDbBQAATHOIMfOCmTSjEmU+/vrrr8zMzJqaGpVKFTjGBIkgCDab3dXVRccGegLz1Xz79u0ajaagoEChUKSmpprNZvpUXl5eUVFRXV0dhmHDw8M5OTkIoYcPH75588ZgMFitVhzH169ff+PGjWDGdbvdc1n63+kyk8mUk5NDxwMfMxNoAAAwX+Y5xsTGxkZGRn769In6INzf3099Emez2VREiY6OJgji27dvYrGYvvNACE1OTvL5fPqQIAiPx0PVd7lcExMT1C0U9Y4AXWdoaIi6lTEajYsXL/Y7pYSEBB6PZ7fb16xZE8KKgmyO47harW5qamIWfv361Wq1nj17ljpkftJfu3bt2rVrEUK5ublKpXJmjPE7LjN6BWPHjh1Xr141Go04js88GxUVFR0d/e7du1WrVtGFs11BAAAIwTx/zz8iImLPnj2lpaVDQ0M9PT1arZZ6yUoikbjd7rdv3/L5/KysrMrKytHRUfp1rA8fPixZsuTOnTujo6MOh6OlpaW4uLioqAghJBQKMzIycBz//PnzwMBAWVkZczgcx0dGRqiBlErlbLNSqVTFxcU9PT2jo6NXrlyZ6+1RMM0LCwubm5u3bNnCLJRKpdHR0bdu3XI4HAMDA1qtFiHU19e3bdu258+f22y2oaGh2tra1atXU/UlEglBEAMDA/MybYTQihUr4uPjDQYDc3Po770ihEpLS9Vq9fv370dGRo4dO9bS0jLbFQQAgFAEflzDfObv99n7zFNOp1OtVkskksTERPrRPUmSOI4fPXqUJMne3t709HSRSFReXk530tDQkJ2dvWDBAh6Pl56efvv2bbrDwcHBzZs3CwSC5cuX19TU0M/8BQJBZWVlbGysSCQqLCyknj/7/YoJQRClpaWJiYk8Hi83N5d6oB1gRT6HfpvPNpZP25cvX2ZkZGAYFh8fj+O4SCRyu91arTYlJSUyMjI2NlalUjG/xaLVank83v379/2OG+ALNLO9aKDRaHJycpjVmD14PB6NRiORSDAMy8vLo97F8HsFg98uAACgsUiS/G3xbHp6er6y/2azeeXKlRMTE/PSGwAAgHD4rb+JCY+XAQDgXwV+dxkAAEC4QIwBAAAQLr/1eQwAAIB/FbiPAQAAEC4QYwAAAIQLxBgAAADhAjEGAABAuECMAQAAEC4QYwAAAIQLxBgAAADhAjEGAABAuECMAQAAEC4QYwAAAITLfwCPhnt0aAJRCQAAAABJRU5ErkJggg==)

Screenshot: spojenisbohem.cz  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 4 November, 2019 21:14 GMT
Vulnerability Verified: 4 November, 2019 21:20 GMT
Website Operator Notified: 4 November, 2019 21:20 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 4 November, 2019 21:20 GMT