Lucene search

K
openbugbountyGh05tPTOBB:1027522
HistoryNov 30, 2019 - 11:09 p.m.

services.ctilogistics.com Cross Site Scripting vulnerability

2019-11-3023:09:00
Gh05tPT
www.openbugbounty.org
6

Security Researcher Gh05tPT Helped patch 6858 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affectingservices.ctilogistics.com
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: services.ctilogistics.com
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **Gh05tPT Helped patch 6858 vulnerabilities
Received 10 Coordinated Disclosure badges
Received 48 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAJ5klEQVR4nO2cXUhTfxjHT2o69Szftqlr0iYiXlWEiIZRdBFmQ+zFF2qVURiEhkiJeWGWhKYYRmLeBNpNd0O8EhECkyFm6+T7GzJnvmDTWkybQ7f/xaFxOOd3fjv/uZNDn8/Vec7OeZ7v8/yeeHZ+Z3nI5XIRAAAAACACAXstAAAAANi3wIwBAAAAxAJmDAAAACAWMGMAAAAAsYAZAwAAAIgFzBgAAABALPx3xmg0mm/fvvGZwD7GP9faP1UBgJ/jpzNmZGTE6XSeOHECaQL7GP9ca/9UBQD+j4cZMz8/L5VKkR9Zrda6ujo+c5d0dXXl5OTwmT4Ek6BIMAvljr4bGULuRQb1T7xba3xSfJ8KLwVeldglFe7fzxcXOIi4sJhMJpIkhXyEudIL0tLSenp6+EzfYrfbRfKMhFUoOvouq+cxBWRQ/8TrtcYkhSmvwFLgVfm2+Xfp358XFziA+ONe2fLy8vT09Llz55CmzwkJCRHJ8z+L/n+d7G3KGHaz1t4lJeQusTvQt/jt4gIHE0Ez5vXr1xqNJiYm5ubNm1arlSAIq9WqVqttNtuhQ4c6OjqY5qtXr6RSaWNjY2xsbFRU1O3bt//8+UP7+fz585kzZ6RS6dGjR69evToxMYEM19XVdeHChcOHD3NNPg9bW1t3796VSqXHjh17+vTpzs4OvWlQV1cnl8vj4+PfvXtXUFDw4sULd5SMjIyOjg7W3sLOzs6TJ09iY2PDw8Pz8vLW1taQzgWmw/XGqhtmZ2NjY+P+/ftyuTwhIeHZs2d00OXl5UuXLkmlUo1G09TUFBUVRXC2R7iq8EGRKXuRGp9mOlxTU5NGowkPDy8oKFhbW3v8+LFcLo+Jiblz587GxgZy6ZEhBBYBycuXL1k9ydqrpEVGRUXduHGD7nOuKowwN5iGycjICA0NlcvleXl5i4uL+LgC9TObXGBGyBoCgBh4njE2m42iKIPBMDg4uLS0VFlZSRBERETE5OQkSZJ2u12n0zHNy5cv22y2wcHBoaGhoaEho9HY0NBAu9JqtUVFRWazub+/PzMzUyKRICNiXsbweXj+/Pnm5ubw8HB3d3dfX19bWxutfHJycnR0tL29PTMzMz8/v7Ozk75+eXmZoqjc3FxW6IaGht7e3t7e3unpaaVSOT4+zudcSDpcb6y6Ycr+8OHDpaUlo9HY3d3d1dXV2tpKEERJSUlwcPDs7Gxvb+/79++RN3JV4YMiU/YiNT7NxN8W6u/vpyhqaWkpJSXFYrEMDw8PDAyYTKaqqirkWiNDCCwCF5vNNvQXZk8yLxgeHqb73Gw286nCCHPD1zBGo7G4uHhlZWV0dFSlUpWUlODjCtHPanKBGXlXQwDwBvxWmslkIgji9+/ftGkwGBITE90fId/H0LeYzWb6vF6vT01Ndblc6+vrQUFByM1is9msVqvpY5vNRpLk+vo618R4kMlkNpuNPqYoKi0tjZbh9uNyuTY3N48cOUILa21tzcnJ4WahUCiMRqNH53gxeG/MiMyiMWVsb2+TJDk3N0ebXV1d6enp29vbEonEfVKv10dGRrLu5VOFDMon0rvUkJpdf/vh169f9Pn+/v6AgIDNzU3aNBgMSUlJ9DFr6ZHVE1IELnw9yWpad5/39/e7+5ylCimMFR3ZMCxmZ2fj4uIwcQXqZzW5kIz4aggAYhDkcQiRJOnehVAqlevr6x5vkUgkCQkJ9HFKSorZbCYIIioq6tq1a+np6efPn1cqlampqWfPnnW7NRgM9HFPT09aWpr74Z1p8nn4+fOnxWJRq9X0LU6nMygoiFbO3AQIDQ3Nzs7u7OwsLS3V6/VFRUUs2VardX19/fjx48yTfM4x6WC8CWR1ddXhcGg0GncNTSbT6uqq0+lknuTe6FGVkJS9Sw2pmT4mSTIiIoI+VqlUR44cCQ0NpU2lUmmxWOhj5lrzVU9IEeRyufv4x48f9AGyJ5kw+1ylUrn7nNWQHpeVr2EIgvj69WtFRcX4+LjD4XA6nU6nExOXBZ9+VpMLyUhIDQHAV3ieMT7kw4cPX758GR0dXVpaKi8vP3369Js3bwiCCAwMjI+Pp6/B/2oZ6cFutwcEBAwNDbn/MQcEBDgcDq6A/Pz8lpYWnU43ODio1+uRIgMDA5km0jk+HYy3f4AQVSy4IvckNe7vg70LQVGUjxQRBM+vljHCMA2Tm5t77969trY2iUTy/fv3rKwsH+oEAD8F/5jD3RBzP1YL3Cvr7Oykn+tZUBSlUqlYJ7e3t2UymfspnmViPJAkid++oLHb7dHR0c3NzVeuXEFeplAoKIpi3cV1LjAdpLdd7pWZTCb6pJBtIrcq/F4ZV6QXqWH2yvhaiGly1xopzIsiuPh7kq/+GFVIYazbkQ2zuroaFBTkNimKioyMxBdHuH6uEoxnvhoCgBh4/9tlmUxmt9tnZmaQZnl5+eLi4tjYWE1NjVarJQhiYmLi4sWLHz9+XFtbW1hYaGlpOXnypNvb1tYWQRAGgyEuLs79FM8yMR50Ot2DBw/GxsaWl5cbGxtra2uRmkNCQrKysqqrqwsLC5EXlJWVFRcXj4yMLC4ulpaWfvr0ic85nxg6EYw3VqFooqOj7Xb71NQU/RukwMDAwsLCsrKyhYUFuobXr18PDAzUarVlZWXz8/P0Sa5+PlXIoHwivUsNqRlZZCSstearnpAi8MHtSS9UIYWxlg/ZMHK5PDo6+u3bt1ardWZmRohyZsG9049kNzUEgP8NfgThv2fV1NSEhYW1t7czzaamJpIk6+vrFQpFZGTkrVu36Be8DoejpqYmOTk5ODhYoVDodLqVlRVWlEePHlVVVbn9s0yMB7vdXlZWplKpwsLCsrOz5+bm+L7YdnZ2kiTpfufMfYCoqKiQyWQSiSQ3N9disSCd84kR4o1ZN+b1lZWVzGLabLbi4mKZTKZSqWpqara3t10u18rKilarJUlSrVbX19dzv8JjSoQMihTpdWpIzQKfY1hrjamexyJwoT9taGhg9aTHb/1cVXzCmMuHbBiXy9XX15eamiqRSOLi4srLy/HPMdxHT4x+VqYey46sIQCIgYcZ4wW7+T/PycnJAwMDfCbAZHJyUqFQ7LUKn+HdWotdhIPQgfuskQB/45++8/fI1NQUxgSYUBSVmJi41yp8hndrLXYRDkIH7rNGAvwN/5oxAJ7a2lqlUpmTkzM3N1dVVVVdXb3XivYAKMLugRoC/w6fPxmJ/fcBDzJ9fX2nTp0KDg5OSkpqbm7eazl7AxRh90ANgX/GIZfLtddjDgAAANif+OPfXQYAAAD2BzBjAAAAALGAGQMAAACIBcwYAAAAQCxgxgAAAABiATMGAAAAEAuYMQAAAIBYwIwBAAAAxAJmDAAAACAWMGMAAAAAsfgPYU5/h9RZg3wAAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nO2df0wb5/34L9QhjjGEUOPwwyGGRoRQSglKaZLRCJGpo8xiXpdlLqOEUZYSRglDNCNWxhiJKKVUymiFWEcrN4vSaJoihBBiEY2oRyNKiOUQlzkedYE6nkccYojLDEm47x/PN/e53j333PkXBPq8/rIfP/c87/f7uefevueee7/XkSRJYDAYDAYTBEJWWgAMBoPBrFmwj8FgMBhMsMA+BoPBYDDBAvsYDAaDwQQL7GMwGAwGEyywj8FgMBhMsMA+BoPBYB4jEhMTr1+/vtJSBAzsYzAYDOZx4caNG0tLS88+++xKCxIw1qyPmZyc3Lx5M+LX8PBwn1v2+Vh/+Oyzz3bt2hUWFrZ3794bN24svwB07ty58+qrr0ZHR8fHx584ceL+/fsrKGSQRmQt6eI/s7Ozb7311kpL8X8gRmdFZjd1IPrKw0t3d3dBQQFBEPfu3Tt27Ni2bds2bty4Y8eOt99+++HDh6DOxx9/vHPnzo0bN+7cufO9995jiLGOxtatW+nTc2Ug1ygTExORkZGIX6VSqc+Nezwen4/1mZiYmK6urpmZmYaGht27dy+/AHTy8/MLCwttNpvZbN6zZ8/JkydXVshgjMha0sV//JwyAQcxOisyu6lO0VceXrKysi5dukSS5MGDB9Vqtdlsnp6e7u/vz8nJGR4eJknygw8+UCgUPT09TqdzYGBg+/btjY2NDDE8Ho/H45mfnx8dHaVPzxUB+5hVg0wms9lsJEn29PSkp6evoCRutzskJMTlcoGvg4ODycnJ4PPjI6T/rCVd/OdxmzKI0VkRUW02W2ZmJviQlZXlWyN2uz0yMnJxcXF+fl4kElFTjI5CoQBOCGAwGCQSidvtBl/Zug8ODqakpPgmT0Dg9zEPHjyoq6uTy+USieTgwYNOp5MkSbfbfeTIEZlMplAoGhoaHjx4QD5Sr7W1ValUSiSSQ4cOOZ3O2tpamUwWFRVVUlICDCGwGkmSw8PDe/bsEYvFMpns4MGDNpuNfmxkZGRhYSF9GGw224svviiVSpOTk5uamoT7GKg6JEna7fb8/HypVKpUKltbW0GD9GPR8tDrNDU1yWSymJiYzs5ORu+UO0S3Vl9fn56eXlFRkZ6ebjKZGL2wbQXtmksp0EJ2drZUKo2Li3v55ZfHxsYEWo/uznmFhHbh8XhKS0ulUmlCQkJ9fT2wP1dldjnvaAoZJjY+6AJVhKsytJCuC+8sE6gLewojRhAqmMvlolY+dDqdENnQU5ttKOi56tvoBGR2+3bOMOjr6/OqQkdHx6FDh4DMIpGIMhcFGIjFxUV64fDwMMLHjIyMKJVKbyUPIPzPY1paWvr7+/v7+y0WS1xc3NjYGEEQVVVVdrvdYDD09fV1d3e3t7eDym6322g0Dg4OGo1Gu92ekpLidDpHR0eHhoYmJia0Wq1X1QwGw5EjRxwOh8lkUigUlZWV4NjR0dErV64MDw9PTU1RlQmCqKysjIiIGBsb6+3tPX/+PFUezYKhI5c6lZWVoaGh4+Pj/f39Z8+ehdoHIQ+9jtlsNplMOp0uOzsbYW1Ea1Kp1Gq16nS6vr6+p59+mnEg1FbQrrmUUqlUJSUlU1NTg4OD2dnZYrFYiOkYoIWEdkEQRGNjI7iv7+vr0+v1HR0diMpc5RTQ0UQYlktHH3SBKsJV2TdF0LpAgU5hBGzBNm3aZDabwSJMUVERWjYhUxtqKOg08W10hJiRd3Zz2Vn4pCgpKTlw4MC1a9fYP129evXAgQMlJSX0QuphTFhYWH5+vkaj+fzzz7/99lu6SGKxeP369fSjnnvuubCwMKgAs7OzDQ0N+fn5XBIuB7xeSC6XGwwGesmDBw/AAIOv3d3de/bsIUlyYmKCIAj6EkpISMj8/Dz4euXKle3btwuvxmB8fDwmJgYcOzc3Rx2blJRESSUWi6empsDXixcvUn/NbCzo3p5LHdAgVU41yLiP4ZKHAtSZmZmhl3Ddx3C11tnZmZ6e7nA4cnJy8vLygEHkcjnbUJStoF1zKTUzMyMSidgr0WzTIeRHC8nVBUmSMpmM+iNmNBqzsrK4KkPLeUcTPUxQHX3Tha0IV2WuFihd0LMMfcoxYE9hxH0Mr2C8sgmZ2mxDsc9VgA+jE5DZjbAzVCQobre7qakpKirq0KFDFosFFFoslkOHDkVFRTU1NdHvVNxut1QqpSwwNzdXV1eXnJwsEom2b99OvyPn6o4SW/aI0NDQwsJC9v3QcsLjY1wul0gkou4uAXa7PTQ0lPpqsVioKxriBpyxIsRbjSRJg8Hwwx/+MC4uDtxrR0ZGIo612+1isZj6aWxsTOBaGZc6jHKqQfZaGZcu0DqIoxCtUZcJu90uk8mampqGhoYyMjKoymxbQbvmUookSY1Gk5GRUVNT09raOjAwwGU6hJy8QkK7mJmZoc+KqKgocLHgkoddzjuaQoaJgQ+6cCnCpQu0kBLVt1nGBjqF0Y2gBfNZNuor1FBePURBj05AZrcP5wwXMzMzarVaJBKBryKRSK1Ws1feLl68mJubyz7c4/FcuXIFPLq32Wz0qxybiYkJiUQCPJ9Op4uJiaF8/EohEnKv88QTTwTgjsl71Gp1WVlZR0eHWCy22Wx5eXm+tcO+mR0ZGfFbuuXj9u3bMzMzu3btIggiNjZWp9Op1eqRkRH6spv/tvrkk0+uXbtmMpnsdntNTc2+ffvee+89tulu377ts5DQLjweT0hIyMjIiEj0/8/GkJAQrsrQ8traWm+VpcPWcWxszAddtFotVBEuXbgUDAZeTeFgCwYd8cXFRWhl30YnqAifFARBfPXVV/X19Xq9vrGxEZQ0Nja2trZWVFQ0NjY+9dRTVE1qoYzBhg0b9u7d29bWVlRUVFtb6/F47t+/T18uu3btWkpKCrVcFhISEh8fTxDE4cOHW1tbOzs733jjDV91DQS8XkgulxuNRnoJ4k45gPcx09PTlOcnSdJoNKLvYxhrZV1dXQFZK5uYmADlXGtlPtzHzM3NhYSE0G/D0ZYBklD32iRJHjlyhCAI6lEn1FbQrrmUYmA0GhUKBdR0JMe+Ml4hubogSVIqlTIWcxCV2eVC1soQw8TW0WddeBXh0oUqFLJW5sM9GWMKc52BCGkFrpUJXKJgG4rrPsaH0QnI7EboInytrLy8XCqV1tTUgK1SFE6ns7q6WiqVlpeXU3LKZDJKTpIkGQtcer0eLNYpFIr+/n6q3GQyIfaVXbhwQaFQrOxueH4f09TUlJWVNTo6arPZKisr9Xo9SZJlZWUFBQVTU1MmkykzM7OtrY0MwlqZXC5vb293uVwWi0WtVqN9DEmSarUabKkymUwZGRmIuTc3NycSicxmM1hDgKpDPtqiPjExYTKZ0tPTvfIx1LhCJ09WVlZZWZnD4bBYLNnZ2byWqaio2Ldvn8lkcjqdOp0O7L2hb3tn24qra6hSY2NjeXl5ly9fdjqdU1NTZWVlKpWKy3okSebl5RUVFdntdiA/kAQtJKKL8vLyPXv2gD/OLS0tjY2NXJWh5Qw12aPpw3XZN13YinBV5mqBLqoPswwKdApDz0CEamCnE3Vl9+cKADWUV2tl6NEJyOwOyFpZUVER5cbYTExMFBUVgc96vT4tLY36yWw2y+XyDz74wG63u1wu8GtTUxP53fdj9Hp9amrq6dOn6W0yzJiamtrR0eGt5AFE0N7l48ePy2QysVisVqt59y5TB/rvY/R6/e7du8VicUxMTE1NDa+PsdH2LtN35UKpq6uTSCSIjZgkSTocDpVKBXY3Njc3C/cxiDqA8fHx3NxcqVSampra1tbGaxmPx1NXV6dUKsVicWZm5rlz56xWq0QiAdcLqK24uoYqtbi42NDQkJycHBoaKpfLi4qKHA4HwnrT09OFhYVRUVFxcXF1dXVgMyVaSEQXHo+nurpaoVBIJJL8/Hyr1cpVGVrOUJNr7zLUsFz4pgtbEa7KXC3QRfVhlkGBTmHoGYgepoaGBvSUET612YbyysfwTgf/Z3cAn8cIoba2VqvV0kt6e3tzcnIiIiIkEkl6evoHH3xA/aTT6VJSUsRicXJyMuUyKTkZZjx37pxSqWRsd15O1pEkuZJLdauHmzdv7t+//7///e9KCxJI1qRSGIy3rPhE2LFjx9mzZ59//vmVEiB4CHrmjyEIwmg0JiUlrbQUAWZNKoXBeMuKT4SbN2+uYO9BZc3GxAwIp06d+vDDD2/fvv3FF19otdry8vKVlsgLrl+/fvToUXb5qlZqTcI1Ul7BfjEQcO/evYAIufYI1ES4f//+K6+8ghcDOFmpRbpVgV6vz8zMDA0N3b59+5kzZ1ZaHO/IyMhobm5ml69qpdYkXCPlFezNTugtT5gAToTi4mLq6T2GAb+PYTy+ppxTSEiIUqlsbGwEz9CC4cC8egxIZ25urqqqKiEhATwWa25upr+DRj0xS0lJoT8xo2tHEIRCoaCeZpPLaAeftXa5XGDnCUmSTqczJCSE2tuGMAj9qEBJAqW6ulosFoPHsAEHMaYBUYGrfSGgHxczRopxEhIEQQWb8ng8Go0GoQ60gtPpLCoqkslk9N0ZdPLy8tD7jhgVrFZrQUFBZGSkXC4vKyuDBuhjqABexTebzXl5eREREXK5vLS0lCv8F1QLhO5zc3MxMTFmsxnaGlRaXpsIUZNuFoPBAF7txLDx2sdIaYGjQRAIsEETFJrN5sjISM8j/BTO5wsEV1hsEhkZm6EdIyz2stnBZ60Rm9kQBkF3F6id9eBKajQaGS+cBwTeMQ1e+0JA+xj2/iXq1PJ4PKdPny4oKCBJ0uPx5OTkHDx4kEsdrgpcWRgAYI8s4lVwdoXU1NTjx487HA6r1apWqwsLC6EaeWiAi3hSUlJZWZndbrfZbIWFhRqNRqAWaN1Pnz5dW1vLJT9UWrRNhKjJMEtg/42tMXzxMfRfBwcHU1NT6ZUDuMPPt5FDhMUmkZGxodpRYbGXzQ4B9zFogyzP9AhqL16NaWDbF4JXPsbhcIB//YDU1NSLFy+CaqdPn0aoA62AyMIAqKioQCcXYVRgv+3Lfp8UKqTH4zlz5gz11ufo6Cj0pVqoFgjd5+bm0tLSqGYZQKXltYkQNRlmwT4Ggb8+ZmRkhD5C7OnEG91aYNdCmgIVuMJik3yRsaHaUSsVwbADIiA/VQcaLh7UoQdCZ0RfZ7xmgTYI4N1335Vy5yAAn6GhzrmSBVA4nU62bIwo7uiA/IhA8ULG9MyZM0qlMioqqqioiBJbYDYEdPtc717YONJMcMW0Zw8N6EUmk9G75r2WQe+K6F/po+NyuaKiohAvQkErpKamvv/++yRJzs/Pl5eXs29HJiYmJBJJVVWVXC6Xy+XV1dWMm9fFxcXjx48XFxcL1AJR2NTUhF59ZUsr8MUXhJpss2Afg8AvHzM9PZ2Xl3f8+HF6ZcaAxcTE5ObmjoyM+CAcoztEU8PDw7m5udSSaEFBgUqlGhwcZFxY0RHlGN25XC6VSlVRUcH+NVB26Ojo+Oijj1wul8PhqK6uVqvV7Ma1Wq1Go7FarWNjYzk5OeC8B0vexcXFDoejr68PLEZT0dfZVy4ug9CPslqtjDbZj6CKi4upd/spy7z88stqtdrhcIyPj1PvS3P1AmRjC19aWqpSqRgv5xMEUVRUZLPZQI8ymaykpAQIkJOTU1VVJWRMCYIAR4G3DqnoHVzGZ8iGbp8tNigHISempqbGx8fT0tIom7BHE3F5qqioADrS1Qmgj2ltbUVc6LkqWK3WiIgIsVgsEolSUlLYZxSwoVarnZ6eBuq3trZSv168eFEkEuXk5CCWYQX6GLfbLZPJkpKS4uLitFotdBmWLa1AH4NQk20W7GMQ+PLMn4qWKhaLy8vL6ecKe8Cg0a0Fwr7xFxgoGxoWm90guzuCOyx2sO1AD8hPFxIaLn4CFggd4QW5DEKvyW6TrTI71DlXjHS2bRlNMTIOSDkC8gtJFcE7ppTYV65cgUbCR2RDQLSPjoUFTTMBjWkPbd/j8URGRgoM6sVVAX09TUpKMhqNiKU8aIWqqqrMzMzh4eFLly4pFAp2MjGPxzM0NER97erqoueFnJ+fB5FREBsNBPqY1tZWELYAeDLoXgy2tAJ9DEJNtlmwj0HgtY+hAkfb7Xb2HweuAWNEt5bR4CohOUZOYKBsAD0sNingPy8iLHYw7MAbkJ8rXDzvJERcuegGIb/rYxiHIBqkFEQkCxAumw8B+amvXt2b0hsRmA0B0T4ibjw0zYRXMe0vXLjATvAcQB9DRZLnOlehFRYXFyUSyejoKPh6/vz53bt3I+QhSdJsNrP3XPX29oLMxEK04CpMTk6mHHl3dzdbEqi0QnwMQk2oWbCPQeD1O5ggcHR8fHxsbKzAgOFfffUViMRHRbc20uAqEdhUY2OjXq+vqKj46quv2PWpsNh/+9vfCIIAyzX379+n17l27RqVaY7S7vDhwzKZrLOzM6h2UKvV+/fv1+v1RqOxt7eXfQgVBR1YZnR0FG0fXhgGWQPwjikXvMb3s302Xo2mTqcrLS31tgvhtLW1VVdXe1thZmZmcXHxmWeeAV8zMjJsNhtvX0tLS/fv37969SpVkpSUZLfbvZf6/7h7967Vat26dSv4mpyczG7QN2nRB/LaDcMg6O/5Hz16NCMjIyYmxmKxnDhxAhTG0+AqIQhi27Zt9LeUoU2dOHHCYrHI5fKMjAzqZWnG/AePAQiC2LRpk0Kh0Ov11E9ffvnl/v37oZKfPHmypaVlYWHBTwtwCX/79m273f773//+qaeeio+PZ6faJQgiNjZWIpHMzMxQxomNjfWhdy6D+I9cLg8JCZmcnARfzWazb42EhoZ+/fXXVCNKpVLgsV6NKYUQ4/O2zyW2XC4nCOKbb74B5RaLBXwQPpq3bt0aGBgoLCzkUZ4PmUw2Pz8/OzsLvtpsNiAbQRADAwMlJSXR0dGZmZlzc3PsnMHQClu2bBGJRNT/OehIffrppyC5C2BsbEypVC4tLe3bt+/u3bug0GKxJCQk+KOaRCJZWlqiG5/dIFRahE3QB4LPvHbDMOG90xGyAkOvzLjxREe35oX+kENgoGxEWGwSGRmbrR09LHYw7AANyM+ITA4NFw8VgB59fWpqilquQRuEOsq3tTKSI0Y6+d2x47WetwH56V+Fjyn9KOHZEBDtc8WN50ozwR5N+khRNDc3gz0IDLxdKyM5sjCQtLgAQ0NDERER7KAAXBUqKytzc3OtVqvBYEhOTmZv63K5XDKZrL6+3ul0GgwG6kmJSqXSaDQ2m81oNKampra3twvXAlqoVqvz8vImJiZGR0dTU1M/+ugjdlNQablswnsgl1nGx8eDGpV5VRN0H+MPPq9yIsJik9yRsdnd0cNiB8MO0ID85Hcjk0PDxXMJQEVf93g89DxOaIOAo8DeZYYWQnwMbwYEdFMAbwPyM74KHFP6UcKzISDaF7J3mb6fmz2ajJECpKSkdHV1scVAP26BlkCzMDAOQT9XYJja4/FUVlbK5fKEhARqwxjjQJCVUiqVJiUltbS0UJJoNJrIyEiFQoH4Yye80Ol0AtUSEhKoYDyMalBpoTYRciCXWf7+97+zH55hADhe2ZqlqqoKmh48qIB7pmXudLXj80gF/FGzzw0u/4GPjyQej0epVLL312EAOLb/mqW1tdXPDQI+sOIx0lcj/oyU8AdXwW5w+Q8MeIO+Hbhhw4Zz58794Ac/8K3TNQ/PM3+vwlYnJiZev349EFJhAsD69eufe+65YLTMGGicLMBPfB4pqVTa1dUVQEl8bnBycjI9PX05ewx4g/5Igh0MAv48mIcPH15aWvrrX/+Krnbjxg2VSkXtL8KsVdgD/c9//rO6utpkMiUkJFRWVh47dmwFxcOsCLt27dJoNL/73e9WWhDMYwf/3uXq6ur+/n7eat3d3QUFBQRB3Lt379ixY9u2bdu4ceOOHTvefvvthw8fUtU+/vjjnTt3bty4cefOne+99x5VPjk5uY7G1q1bT5w4Qb2UMDk5GR4ezq75xBNPJCYmnjp1CnSxDgZC5s8++2zXrl1hYWF79+69ceMGr46POZOTk5s3b0b8CmyIrsYLe6BffPFFt9vd2NhoNpspB/NYDbQQ6F17C+Kc57IDgTSFQDsQfpvCZ61nZ2ffeust8PnOnTujo6PUWyMIa9CPCqAwbH77299u3Ljx448/DkhrbKDDGij5EefMqoT3iY3AR2FZWVkgNu0qiqsfExPT1dU1MzPT0NDA+7ry4w96Mxv9fX5/9v6txoEWgj8Pn7lMgU4KgDCFQDuQfpsiIE/IGY34nEiCDFAuiaAmkiC5hzUg+xf8TCTxGBIYH2O32yMjIxcXF1dXXH2ZTAa2/Pf09KyBrYdoxW02G4jeYbPZ6PGjvGKVDrQQfL5AIEyBTgqAMIVXdiD9MEXAfcyaTyRBcg9rQPr1M5HEY4jv7/n/4x//oD53d3e/+OKL69evX1paIghCJIJsV5udnbXZbDk5OVTJrl27BgYGuNoXi8Uej0eIJGKxGP3WOl1UOhUVFfn5+b/5zW+0Wu358+fpP4Hb3nfeeWfLli2bN28+fPjw//73P/DT1atX9+7du3Hjxujo6J///Oe3bt2iyl944YXw8PD4+Pif/exn//rXv7gKf/rTn77zzjvgqOvXr2/YsIF66/j1119/8803v/3229dffz06Onrr1q1//OMfwVIDEOmtt96Kjo6OjY398MMPCYK4devWj370o/Dw8B07djBUYBAfH3/t2jXw4YsvvuA1DrTCKh1oHxBuFi5TeGsHQrApfLYD16lLZ2Fh4bXXXgsPD9+2bdsf/vCHhw8fsk+82dlZpVLpdrvXrVvHWI9Cnxj0o9jN0pdzw8PD33333cTExM2bN//yl7+kJghBEP/5z39+/OMfh4eHJyYmvvvuu4yF3zt37qB7IQgCMb9Ap2FhYb/4xS/u3Lnz5ptvRkdHP/nkk7/61a9AsAzeYf3Tn/6UmJj45JNPvvrqq5TYUMtDDevtOfP444uPuXr16oEDB0pKSqgSao0+LCwsPz9fo9F8/vnnjPglbrdbLBavX7+eXvjcc8+FhYWxu5idnW1oaMjPz+cV5vbt2ydPnlSr1Yg6JSUlBw4cAFdYOlKp1Gq16nS6vr6+p59+mvGr2+0eHh4eGRkZGRkxGAwtLS2g3GAwHDlyxOFwmEwmhUJRWVkJylUqVUlJydTU1ODgYHZ2NghPwlVIPeLq6elZWlrq6+sDX/v7+/Pz86uqqux2u8Fg6Ovr6+7ubm9vp0Qym80mk0mn02VnZxMEUVlZGRERMTY21tvbS/cx0Sy8NQ6xhgbaB4SbhcsUXtmBEGwKf+zAderSaWxsBAt3fX19er2+o6ODYJ14mzZtopI1FBUV0Q9HnBjso9jnM4Xb7R4dHb1y5crw8PDU1JRWq6V+qqysDA0NHR8f7+/vP3v2LEP+J598krcXxPwyGo2Dg4NGo9Fut6ekpDidztHR0aGhoYmJCSADelhBC0Bsu91eV1eHtjxDNm/PmdUB750O/QYQGkjf7XZLpVIqHPpqiavf2dmZnp7ucDhycnJA5sHx8XHq/UHQCz08O/SBDRUTfmZmRiQSMVaToYUkSdrtdolEAsqzsrJqampAJteJiYmIiAiPxyOFRYyfgIXE54ohb2PBZXnhGRNW6UALhCG2cLNwmUJIMAguU3hlB7YphNgBnLpsIaHZB4hAJ5IgYecz/ZEhAUskQQrLJYHuhSsjw4TfuSQmgplIYvXinY+BBtKngl0zeMzj6svlcpCcw263y2SypqamoaGhjIwMqhFGeHbK/UBjwpMkqdFoMjIyampqWltbBwYGEIUkSWZkZFy+fNnhcCgUCpfLJZfLHzx40NnZ+fLLL3NFjGeff1wx5H1ASMaEVTrQ0LQR7ELo9PYqkQTDFGg7oE3hlR24TMEQnoSdugythWcf4A0ORLJODN6j6D6GKwKQkFwS6F4Ezi+u2EWIYUW04H8iidWLd2tl0ED61PoJg8c5rv7t27dnZmZAdNjY2FidTldfX9/S0sK4YYfCFRP+k08+AfdGi4uLNTU1b7zxBlchQRD5+fn9/f09PT0qlWrTpk0ZGRl6vR4slAlRhxfha2WE4IwJq3GgCY60EUJySXibSIJhCl47EIJNERA7EMueS2LtJZIgfM31sPyJJB4jeL0Qw9k6nc7q6mqpVApy1j548EAmk1E3niRJMrZA6PV66oZRoVD09/dTP5lMJq7tRhcuXFAoFNSCgJA/TXSBGX9tysvLpVJpTU2N0+kEJeCOm76McOTIEYIgTCYT1QhBWyvr6uoCa2XT09P0P4ZGoxH6V9poNCoUCkThlStXsrKyCgoKent7SZJsb2+vqqqKiYkBf1S57uUZijPWyrq6unxYK2MbB7A2BtpnBJoFwGUKhB1IpCm8sgPJMgVUeOipy25cKpUKSb6JkBBxYvh/HwPO+YlHIcyFrJWxZ42Q+cV1H0NyDytXC1wXDahh0efMaoTfx0DDVk88CqQPAsVT5asorn5FRcW+fftMJpPT6dTpdDKZLCYmhn5TTxAEPTx7Q0MD+AkaE35sbCwvL+/y5ctOp3NqaqqsrEylUkELKQHkcrlcLgfXFJvNFhERQa3UQSPGQxXniiEvHIEZE1bvQAvHh0QSJNIUCDuQSFP46WO4hGefuoxEEiQs+wBUAD8TSUD1EuJjSAG5JHitJ2R+IXwM17AiWghIIolVCr+PQYetrq2t1Wq19JLVElff4/HU1dUplUqxWJyZmXnu3Dmr1SqRSPR6PdVLc3OzXC6PjIwsLi6m1sqhMeEXFxcbGhqSk5NDQ0PlcnlRUZHD4YAWUgIUFhYePHiQ+rp7927KktCI8VDFuWLIB5zVO9AC8edxK8IUXHaA9kiZwk8fwwX01KUnkiBh2Qe4BPAnkYROp/PZx/DmkuC1npD5hfAxJMewIloISKTBgGgAAAkjSURBVCKJVQpPvLKFhYWUlJSTJ0++9tpr0Ao7duw4e/bs888/H/BFvJVlcnIyLS2NnoXze85aHWhMQDh27JjJZPr000+Xud+bN2/u379fYNBezIrAE9ufN2z1zZs3Ay0S5nEEDzQGwYokkiBwLonVAH/+GBy2GoPBoAleIgk2p06diouLKygosFqtWq22vr5+efrF+IbvsWS84vr160ePHl2evjABh55GyKuUQgTOKoQJNDk5Oe3t7QqFoqioqKqq6vDhwystEQbFMvmYkpKSgGe7Cyrbtm3DD2Mo1q9fHxoaWltby/jMy40bN5aWlp599tkgC4j5HvHCCy9cu3ZtYWHh3//+N05W9PgTAB/Dm4+Enl6CkTNj3bp1iYmJoNrCwsIrr7yCTsAArXPnzp1XX301Ojo6Pj6enowE8NJLL/35z39Gq0Cv8/XXX//kJz/ZvHnzli1bfv3rX9OD8VH6MlR46aWXwE83b9586aWXNm3atGXLltdee419LEJNhPr37t2LjY2FPhHhkhZtEyFqMuxGTyMkMKUQsTqzCmEwmACyHPcxbrdbIpFs2LABfJU+Sobh8XhOnz4NUrQuLCzk5eWho8ly1SkuLl5aWjIajZcvXx4YGKC/2Hzz5k2DwVBcXIxollFHpVKlpKSYzeahoSGn01lRUcE+hK6Cx+Pp7u4G5fn5+QqFwmw2GwwGj8fDzjrMpQJa/ba2tqKioh07drB/4pIWYRMharLtFhUV5Xa72Z/RUD6mtLR0amrq0qVLU1NT7e3tfX19BoMB1PnLX/5y8uTJ1tZWm83W0dHR1tZ26tQpqgUpLXVKb28vVBdGTbfb3dXV1dPT09TURBAENMOKEOExGEwA8H/7M+/efPo2cIfDAQJQAlJTUy9evAjqnD59Gv0qALSO2+0OCQmhR7JLTk6mfq2oqKBeq+SCXof9Ri77dX1EdKYzZ85QEfFGR0ehx0LVRKg/NzeXlpZGNUuHS1q0TYSoybabt29skGs62QwGgxEIv4+Bvq9Ef/WvqamJ/qptaWmpVCpNSEior69HB+IdHh6WyWTg5TuAwNfNGC86cb335HK5oqKi6K89smHXSU1Nff/990mSnJ+fLy8v12g0bAEkEklVVRV4Ub+6upodpnBxcfH48ePFxcVCVECXNzU1Ue/HsYFKi36bjFdNqN0E+pi+vj7qc0dHx6FDh8hHb3dD42G4XC6CIOjnAEmSw8PDXD5mZGREqVQKEWlkZITuWdlGoIuKwWCCBL+PKS0tValUjLgLIITJ1NTU+Ph4WloaNXu1Wq1Go7FarWNjYzk5OeAqxnVJqqioqKqqopcE1se0trZyXeUp2HWsVmtERIRYLBaJRCkpKewrIwgzo9Vqp6engfqtra30ChcvXhSJRDk5OVyJY4X7GLfbLZPJkpKS4uLitFot25lBpRXiYxBqQu3G62OGh4dzc3NBCFtAfn7+uXPnwOeCggKVSjU4OMiwJ2+QZnpHLpdLpVJVVFTwijQ9PZ2Xl3f8+HGEEWJiYnJzc0dGRrh6x2Aw/sPjY6Dx4xBpS9jJJ0iOS5LH44mMjBQSfY+BcB+TlJRkNBrRiyTsOlVVVZmZmcPDw5cuXVIoFJ2dnWzJh4aGqK9dXV2M1MXz8/MgTBMVhgutAqK8tbVVrVY7nU7gzNiBJaDSCvExCDWhdkNc0L+HyWYwGIxAeHwMNNcCV9oSaPIJkuM6cuHCBXYYtAD6GCrZCcLHsOssLi5KJJLR0VFQ4fz589DUZHTMZjP9zztFb29vZmamEBUQ5cnJyZQv7+7uZgjDJS2vj0GoyWU3hI9ZS8lmMBhMYAnkvjKvkk/odLrS0tIA9s6gra0N7Jb2qs7MzMzi4uIzzzwDvmZkZNhsNt6+QA7z+/fvX716lSpMSkqy2+1ey03j7t27Vqt169at4GtycjKjQd+kRR8oxG4M1lKyGQwGE1h4fIxcLg8NDf3666/BV7PZrFQq5XI5QRDffPMNKLRYLOBDbGysRCKZmZmJf0RsbCy02Vu3bg0MDBQWFvqvgEwmm5+fp17vsNlsQLyBgYGSkpLo6OjMzMy5uTloni52nbS0NJFIRF0rgb6Moz799FOQ3AwwNjYG6iwtLe3bt+/u3bug3GKxJCQk+KOaRCJZWlqiG5/R4JYtW6DSctmE90BCmN0YnDhxwmKxyOXyjIwMEM3h4cOHPT09dB/DSLLk8XjARu1NmzYpFAq9Xk/99OWXX+7fvx/a0cmTJ1taWhYWFtDyCOTo0aMZGRkxMTEWi+XEiRMBaRODwTDhvdOB5lrgSlvCTj5Bfje9BKC5uVmtVrP78mGtjCTJvLy8oqIiu91usViys7OpRRjA0NBQREQENE8XtE5lZWVubq7VajUYDMnJyew9XS6XSyaT1dfXO51Og8FAf0yiUqk0Go3NZjMajampqe3t7QJV4CpXq9V5eXkTExOjo6OpqakfffQR4xAuaaE2EXIgl93oaYSgKYVIWlaV70OyGQwGI4QA7F2mpy1hJ58AhYykkykpKV1dXey+0M9auAqnp6cLCwujoqLi4uLq6uoYG2HpFxfExZ2uQmVlpVwuT0hIoDaMMQ4cGRnJzs6WSqVJSUktLS10STQaTWRkpEKhgKYt4hWDUe50OoFqCQkJzc3N7DpQaaE2EXgg1Cbkd9MIoVMKkd+DZDMYDEYgAXgHUwhVVVXQJ8BoBL7rtwwNLv+Bj5UkHo9HqVSCvWf0z1wkJyfTt95hMJjvLfyx/QOCz+klAh5J0+cGl//AgDfo84H0NEK8KYUInGwGg8E8gicP5spy584dl8v11FNPrXiDy3/g4y8JBoPB8PJY+xgMBoPBrGqWKX8MBoPBYL6HYB+DwWAwmGCBfQwGg8FgggX2MRgMBoMJFtjHYDAYDCZYYB+DwWAwmGCBfQwGg8FgggX2MRgMBoMJFtjHYDAYDCZYYB+DwWAwmGCBfQwGg8FgggX2MRgMBoMJFtjHYDAYDCZYYB+DwWAwmGCBfQwGg8FgggX2MRgMBoMJFtjHYDAYDCZYYB+DwWAwmGCBfQwGg8FgggX2MRgMBoMJFtjHYDAYDCZYYB+DwWAwmGCBfQwGg8FgggX2MRgMBoMJFtjHYDAYDCZY/D+ABtc1fslwnAAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAH50lEQVR4nO3cX0hT7x8H8LMt5swzdbotnTOdhnoREuSFgVl00R+SEMqKMqybFTFtDBIVikWgEnkRSN1YWBd1JyEhXUiFyaiEuczmX2ybbi6dy5XKmnPnd3F+HMb+nE2/nvz29f26iD3Pnj+fz2P0YeeZ8SiKIgAAADjA3+oAAADgPws1BgAAuIIaAwAAXEGNAQAArqDGAAAAV1BjAACAK6gxAADAFdQYAADgSuwaY7VaxWJx/P3xD1gvq9UqkUg2ccH5+fmqqiqJRMLj8Xg8XmZm5o0bN37//s0+y+PxtLS0MCExOf6TfGPOjbYpAMC/Wewak5OT43K54u//i6jVap/PZzKZvF6v1+t99+7d8PBwa2sr+6zFxcXm5mb69WYdQsx1uNgUAIBrcT0rS0hIWFf/X2F1dfXVq1cdHR05OTkJCQkJCQmFhYXNzc1dXV3rWmezDmFd6/zVJw8A20e8z8roP1taWmQyWWZm5uPHj0Oe2KytrTU2Nu7atSspKamqqmphYYHuf/DggUqlSk9Pv3TpksfjoTsHBgYOHDiQmJgok8mqqqrsdjuzUfAWBEHY7fZjx46JxeLCwsLnz58z2w0MDBw8eFAsFmdlZZ0+fXpkZIQgiOXl5atXr8pksuzs7Dt37qytrTHLtrW1qVQqiURy8eJFOgyn0ykUCmUyGUEQHz9+zM/Pl0gkPT09MzMzLEl5PJ7c3NylpSUej/f06VOWx1YRgyEIYnZ29uTJk2KxWKVStbW10U//gtcJT41904gnH/F8gkX7eYWHHXyASUlJ586dW1hYuHnzpkwmS09Pv3LlyvLycsy/RQCwPa3jzn9paWl0dHR4eLizs7OsrCzk3Xv37vX29vb29o6PjysUCrPZTE8xmUwGg+HTp08Oh6OhoYEebDQa1Wq10+kcHh5WKpUajSbaFhqNJjk52Ww29/T0BNeYioqKy5cv22y2/v7+srIykUhEEERdXZ3D4TAaja9fv+7u7n748CGz7NDQEB2GzWZramoiCCIQCPD5/09fo9GcPXt2fHzcaDQGAgGWpFJSUkZHR0mS9Hq91dXVLMcVLRiNRiMUCicnJ3t7e589exY+MTw19k0jnnzE84k5K1rY9M+xv7/fZDI5HI6ioiKXyzU0NPThwweLxUKfJwBABFQsFouFJEmLxUIQhNvtDulnmnK53Gg0hkwkCOLnz59002Aw5OXlha8/OTmZkZHBjA/ewu/3i0Qim81GN7u6ulJTUymKcrvdO3bs8Hq9wev4/X6SJKempuhmd3d3aWlpeBj9/f10GEz8KysrfD7f5XJRFPXmzRt6i2hJhSQe7XW0YOiMmH4mI2ZuxNRYNooYZLRFgkVMLWLY9AEuLi4yB8jn81dWVuimwWDYs2cPy0YAsJ3tiL8akSQZ7WtdHo/H7XYXFxeHT2Ge6igUCrfbTb8eHBysr683m80+ny8QCDAfHUK2mJubIwgiOzubbhYVFdEvJBLJmTNnSktLjxw5olAoSkpKDh06NDc35/P5VCoVM5j+xzEkDKVSyYRBc7vdQqEwPT2dfjdmUvGIFszc3FwgEAjuD5kYMTWWjSIGGXORaKlFC5skyZSUFLpTqVQmJycnJibSTYVCgS8gAEA0m/n7MQKBIM6RlZWV5eXlfX19JpOpp6dnA3u9ePGio6OjuLjY5/PpdLra2toNLEILfmgW/KCMFn9Sm2UDqYUHGc8ifz41ANhuNqfGpKSkpKWlff78OZ7B8/PzDofj1q1b+fn5WVlZ4VcFDLlcThDE9PQ03RwfHw9+d//+/TU1NY2NjU+ePHn58qVcLhcKhd++faPfHR0dzc3NZQmDz+fTFSUtLc3r9f748YMgCJvNtrGkwiOPGIxcLufz+VarlemPOD0kNZaNWIJkWSTarPWeIQAAu037HKPVatVq9ZcvX+x2e21t7fv376ONlMlkaWlpjx498ng8ExMTer0+2kiBQHD8+HGdTme3279+/cqMHBkZOXHixNu3bxcWFqanp9vb2/ft2ycQCM6fP6/Vaqenp+nBFy5cYAlYKpX6fL7BwcGkpKSysrLW1tbZ2dn29vaYSUmlUq/XOzExEbIgXavGxsbW1taiBSMQCCoqKrRardVqDc6IETE1lk0jBhltkeBfL42Y2nrPEAAghpg3Nsydf/A9MxV28+z3++vr66VSqUgkqqysdLlcIQMsFgtznd7X11dSUiISiTIyMnQ6Xci9d7CZmZmjR4+SJFlQUHD//n16pM/n0+v1BQUFQqFQLpdXV1c7nU6KopaWltRqtVQqVSqVer3e7/eHLxschk6nu3btGkVRZrO5uLg4NTW1qakp+M4/PCm6X6/X79y5s7OzM2TxhoYGuj9aMBRFOZ3OiooKkiRzc3NbW1tDco+WGsum4UFGXCTmLLo/PGyWAwxvAgAE41EUxV6ErFbr3r17f/369Wdq3h9Gf+bYqt3HxsbKy8u/f/++VQEAAHBqu/+fmFt7720ymfLy8rYwAAAATsX47vLq6qrBYAj+Ri/8Q3fv3lUoFKdOnZqammpqarp9+/ZWRwQAwJUYNUatVnd3d3d0dPyZaLaDw4cPa7Xa69ev7969u66urqamZqsjAgDgSuz7GAAAgI3Z7vcxAADAHdQYAADgCmoMAABwBTUGAAC4ghoDAABcQY0BAACuoMYAAABXUGMAAIArqDEAAMAV1BgAAODK/wAgCDC1w1dPkAAAAABJRU5ErkJggg==)

Screenshot: services.ctilogistics.com  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 30 November, 2019 23:09 GMT
Vulnerability Verified: 30 November, 2019 23:15 GMT
Website Operator Notified: 30 November, 2019 23:15 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 30 November, 2019 23:15 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 28 February, 2020 23:09 GMT