Lucene search

K
openbugbountyMeltdownOBB:1067007
HistoryJan 13, 2020 - 3:46 p.m.

yachting.org Cross Site Scripting vulnerability

2020-01-1315:46:00
meltdown
www.openbugbounty.org
6

Security Researcher meltdown Helped patch 7 vulnerabilities
Received 0 Coordinated Disclosure badges
Received 1 recommendations , found a security vulnerability affectingyachting.org
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: yachting.org
Open Bug Bounty Program: View Open Bug Bounty Program
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **meltdown Helped patch 7 vulnerabilities
Received 0 Coordinated Disclosure badges
Received 1 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAJBElEQVR4nO3cbUhTbxsA8JPv5uZcuuN7OfMNkTVMzMBMRFLWGMc5KcxagWSE+UFQ0kqKQEExKsxPJumH+mIhY4jIihgyRGWpjaVDzJ3mLFNxNmsMt/0/nOc5nGduR/3ndI9cv0/nOue+r933NfBi52wecTgcCAAAAOABPge9AAAAAIcW9BgAAACeAj0GAACAp0CPAQAA4CnQYwAAAHgK9BgAAACe4r09hsvlTk5OuguB50CpAQB7xUt7zOfPn+12+6lTp1yGwHOg1ACAPbRNj9Hr9Uwm0+Ulk8nU0tLiLvxLMplMJBK5C70fTd2Q/60V/cj9t6tS6/V6Npu98+TetlkAgKf9+88xa2trzc3N7sK/9P/eY+hRa3XixInl5eWDXQ+VR0vtbZsFAHiaN94rW1xc1Ol0+fn5LsPDJzAw8KCX8B/7UGrv2SwAYB/sqMc8e/aMy+WGh4dfvXrVZDIhCGIymRISEsxm85EjR3p6eqjhkydPmExmW1tbZGQkm82WSqV//vwh8oyNjZ07d47JZMbGxpaWln758sXly8lksgsXLvj7+zuFJSUlbW1txMnJycnAwEBiMQiCVFVV1dXV0Q9ITk6mn05dw4sXL4qKisjw3r17Uql0bGzs7NmzwcHBHA6nrKxsYWGBuGqz2RoaGiIjI0NCQsrKylZWVtzVbWvpyNtHxEF7ezuXy2Wz2VeuXCGnLC4uXrx4kclkcrnc9vZ2l7enNjY2qqqqOBxOfHz8o0ePbDYbmbOlpYXD4URHR798+ZI+G7Xy7ja7sLBQVFTEZDJTU1Nfv35NnKQuPiQk5NKlSysrK3V1dRwOJzw8/MaNGxsbGwjlXhnNZgEAh8n2PcZsNk9MTKhUqtHRUaPRePfuXQRBWCzW9PQ0g8GwWCwVFRXUsKSkxGw2j46Ojo+Pj4+Pq9Xq1tZWIpVQKLx+/TqO48PDw7m5uUFBQS5f0d2NMqFQqFAoiJNyudxutw8ODhKhQqEQCAT0AzAMo59OXQOGYUql8tevX+QaxGKxWq2+efPm9+/fNRpNXFxcdXU1cbW1tVWhUCgUCp1OFxMTo9Vq3dVta+mcSj01NUVMwXG8sbGROF9dXR0QEDA7O6tQKHp7e10Wraamxmg0qtXqwcFBmUzW2dlJ5pyentZoNK9evcrNzaXPRq28u81WV1eHhoZqtdqBgQGyx5D7HR4enpiYMBqNaWlpy8vLU1NTIyMj8/Pz5F623SwA4FBx0Jqfn0cQZH19nQhVKlViYiJ5icFgUEcSITEFx3Hi/Lt377KyshwOx+rqqp+fn8Vi2foqOI4nJCQQx2azmcFgrK6ubg2NRuPRo0eJDNnZ2bW1teXl5cQrhoaGWq1W+gE4jtNPd1pVTk5OX18fuTWnlc/OzkZFRRHHKIqq1eod1s2pdE51I6cMDw8TUzY3N4OCgubm5sh6hoWFOS11c3OTwWCQY2QyWU5ODpmTLCZ9NqfKu9wsMZ365hLTiRdaW1sjF+/j4/P7929y+0lJSTvZLADgkPHbtgkxGAzyu0AxMTGrq6vbTgkKCoqPjyeO09LScBxHEITNZkskkpycnIKCgpiYmKysrPPnz5NpVSoVcTw0NJSdnU3ewKGG0dHRKSkpKpUqPT3daDQ2NTWlpKTYbDaFQlFYWOjv708/ID4+nn660y4wDJPL5aWlpXK5XCAQBAYGfvr0qb6+XqvVWq1Wu91ut9sRBDGZTKurqzwe7+/rRp0SFxdHTFlaWrLb7Vwul6zn1olLS0tWq5U6hvgjTuSk3g2jyeZUeZebXVpaQhCE+uZSF89iscjFh4aGBgcHk9vf+qjf5WYBAIfMvj7zf/PmTVdXF4/Hs1qttbW1d+7cIc77+vpGR0cTx/TfKBMIBAqFQi6XC4VCFovF5/OVSiX1Thf9gG2nU4nF4oGBAQRB5HK5WCxGEATDsLy8PKVSOTExQVwi+fr67mGhDoRTqWk2CwAAO+SRHmOxWL59+0Yc63S648ePk5dOnz4tlUobGhq6u7v7+/udJtpsNrlcTv6lcwqR/z6SIf8aYhjW39//8eNHsknQD9h2OlVycjKKou/fvx8ZGREIBD9//jQajQ8ePDh58mRsbCz5MInFYh07dsxzP4xHUdTHx0ev1xPh9PS0yzEBAQFfv34lxyQkJOwqm1Op3W0WRVEEQahv7l/vDwBwqNHfStv60IV6+97Pz0+n0zmFxF0aiURiMBg0Gg2fz3/48KHD4dBqtcXFxR8+fFheXsZxvLKyUigUkpmJpx1KpTIjI4M86RQSUBRFUZQYbzAYQkND+Xz+zgfQX3V66NLU1MTj8ch1oija2dm5tram0+kwDCNL0dzcnJ2dPTU1ZTAYqqurlUolTd2cSkd9ROFuikQiwTBsfn5eo9HweDzyPHW1lZWVIpEIx3GNRpOZmfn8+fOtOWmybS21u81iGEZ9c8nnMTT7JcOdbBYAcJj8+88xISEh9+/f5/P5PT091PDt27cMBiMrKyszMzM3N5fH49XX1yMIkpSUlJOTc+vWLeJhjMVi6erqIlLp9fqIiAhkZz+9LCwszMvLI35mERsbm5KS4vQphH4AzVVyGSSxWDw1NSWRSIiwr6+vu7s7KioqLy8vMTGRHFZfX5+fn19QUJCUlGQwGNLT03dVum11dHRsbm5mZGQIhcLy8nKXq3369GlUVFRmZmZxcbFIJLp9+/ausm0ttbvNdnR0rK+vp6WlicVip+/FAQCAkyMOh2NvM+r1+oyMDPJbv7uSmpra29t75swZl+H+29jYiIiIMBqNu/qPKR41MzOTl5f348ePvc124KUGABxK23+vbD/NzMzQhPtvaGgoNzfXexoMgiATExPUTxV7le3ASw0AOJS8q8d4FZPJ1NHRcfny5YNeCPL48eOYmBiRSDQ3N9fY2NjU1OQ92QAAgIY3/r8yL4GiaFhY2LVr1w56IUh+fn5nZ2dcXFxFRUVNTY1UKvWebAAAQGPvn8cAAAAABPgcAwAAwFOgxwAAAPAU6DEAAAA8BXoMAAAAT4EeAwAAwFOgxwAAAPAU6DEAAAA8BXoMAAAAT4EeAwAAwFOgxwAAAPCUfwDSuqbGN8ntHgAAAABJRU5ErkJggg==)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAXGElEQVR4nO2dbVBT2fnAryGGbAhvMQQIUUKWomMZmrKU0lZtx3W26GaYtHVdVxlldx2XdVhgGd0R1lqKDlpXdyhlGLvDOq5j6X7YoZRxqG1T28lmMhRZJqZZNkaWDTFmFQMLbGQvGLj9cP49/+t9SwhGEJ/fp5vz8pznnPvc++See+5zVlAURQAAAABAFBAttgIAAADAsgV8DAAAABAtwMcAAAAA0QJ8DAAAABAtwMcAAAAA0QJ8DAAAABAtwMfMj6ysrGvXri22FkuUa9euvf7664utBcDL/fv3X3rppTt37kRQFywfiAzwMfPgP//5z9zc3He+853FVmSJUlZWptVqF1sLgJeVK1dKJJKDBw/OtyJYPhAxIXzM8PBwfHx8BHIjrjivJpKTk+dVfoEqdXV1lZSUPIKusQmz0YmJiRMnTkRJuHBzo6Ojdru9urqaLpBxjn73u989/fTTsbGx3/3ud//yl78wdFjxP2JiYrKyso4dOzY7O8vIwvz2t79FWTExMR9//DFDFG6UUXf16tW1tbX379/n6zhb4aysrLi4uO9///v/+Mc/OLVliw3ZU4FGQ/aIPRQrVqz47LPPcOE//OEPa9eunZ2d5TwL1dXVJpOJmCfI8udbi0E4ZhaZAQNLGkoQt9stl8uFy/BBkmRkFcPE7XYnJSXNq8oCVSosLPzb3/62cDmREU6jkZ2viM8yvSLnMf0cNTc3a7Vak8k0MjLS3t6uUCjMZjNDFEmSJElOTU3ZbLbCwsKGhgZGFiYYDKIsgiB0Ol0gEKCLwo0yxDocjh/+8IdHjhzh6zhDYZ1Od+XKFb/f/9FHHymVSovFEo7YcHrK12jIHqFGnU5nUlISOn7jjTf27NmDC+fl5Z0/f57vLER2rrHlL5CQNryQGw6wNImij4k2EfiYheDz+ZKSkmZmZh5ZixGwRHyM1+vNz89HB4WFhShRrVZfuXIF121qajIYDAI6WCyW9evXC6vndrtlMll+fn55eTk9UeCWarVa161bx5dLr8tQ+OzZs1hhYbHz7SlDYeEesVN8Pp9cLne73RRFdXd363Q65IA5z0IE5/pRWv5SvuEAkTG/9zH37t177bXXUlJSVq9e/etf/xpNZXz55ZfPP/98fHx8VlbWmTNn0FM5/bkYHZ85cyYrKys5OXn37t0TExPCDV29evUHP/jBU089lZKS8sILL9y6dQul37p166c//Wl8fPzatWvb29vZ8uPi4l588cXR0dFDhw6lpKSsWrXq5ZdfvnfvHvHgBE6Y+vz1r3/Fx11dXc8999zKlSsZj/z0MsJCrl69unHjxvj4+IyMjF/84hd4fmN2dra2tjY1NTUuLu6FF14YHR1FTZw4cSIlJSU9Pf39999nj+c777yTmpqanJy8d+/eb775hiCIiYkJrVYbCARWrFjxwQcf8CnGN7Z0pqenX3311fj4+MzMzF/96ld44oWuEqM5evWMjIxPPvkEHfz73/9Guvl8vg0bNuAymzZtGhgYEBg3qVQaDAaFx5YgCJFIdOHChfPnz//9738PWZggCIlEMjMzE7IYW+FXXnmlpaUlpNgIespgvj1KT08vKys7deoUQRAnT548fPhwTEwMwXUWwoRhOdjyCR4bDseACdYFGNKA2ZoAjyPz8zGVlZU+n6+/v//y5ctdXV2tra0EQVRUVEgkksHBQZPJdOHCBc6KgUDAbrdbrdbe3l6Px1NXVyfcUH9///79+2/fvu1wODQaTUVFBUqvqKhISEgYGBjo7u7GPgbJt9lsFovFZrP5fL5169b5/X673d7T0+N2u9nNhdTn6tWrzz77bFlZGU7hm5IuKyt79tln0cUsLMRgMJSVlXk8HovFsmHDBqlUitJPnTplMplMJpPL5VKr1eh+FAgEnE6nw+E4f/48/YaF9e/t7e3r6+vr6+vv70f3l8TERKfTieZwSktL+RTjG1s6DQ0NU1NTdrv98uXLZrP57NmzbJUYzbGFMBSWSqXoPoVISEiYnJzkK3/37t0jR44YjUZhsYhvf/vb9fX1r7zySsj/Ll999dXRo0f37dsXUiZb4ZUrV2ZmZoYUO9+echJ+jxCHDx9ub2//85//7Ha76UY7X9hmTzxo+Zw2HCUDJgQvLuCxQfgxh/7oGgwG5XL50NAQ+tnV1VVUVBQMBqVSKU7s6OhAj/CMWRSCICYnJ9FPi8Wi0+nQscfj0Wq1wjoMDg6mpaUhBaRSqcfjYbdFEMT4+DiWLxKJpqam0E+r1ZqdnU09OD3Npw9FUS6Xa8eOHQqForGxEc+JBwIBuVw+NjZGsR7nA4FAY2OjQqHYsWOHy+XiEzI2NiYWiznno1UqVX9/P2PYCYJAzeEUxnjSx6GgoIBdjFMxzrFlT1AolUrcd/RqhK0SWyuBWQ527tDQEH3+B8lXKpVKpVKhUEil0vLycjRc9CxERUUFQ2wwGCwqKkKvJdivN7BYkUhUXFwsoBWuS886ePAgkoDtREBsOD0VnisT7hG7CqK8vFwqlba2tnKM/oMVcev0q4/T7KkHLZ/PhsMxYIp1AYY0YCo8GwaWOPPwMT6fTyKR4CyXy5WWlsZIHBgY4PQxdLuhXx7BYNDn87Hb7e/v37Jli1qtRtcwKu/z+aRSqXBbFOvyY981hMuLxWKj0Yg9FqKjo2Pz5s2c3UGMjY0ZjUaxWCwgZOfOnXq9vqam5vTp0//6179Q4vj4uFgsRhPodJXYtyH6eDLGQaVS8VVkKEZxjS2j1tjYGP2erlAoVCoVZ6/D9zFer5euM0VRg4ODSqWSLkomk3m9Xq/X6/P56ANCz0Lgmxe9UZfLJZPJOjs72a83cEWz2Zyfn9/U1CQwzqguXeHx8XGv19vT0xOO2HB6Go6P4esRuwrCbrdLpdJ5vVSnX32cFks9aPkUlw2HacDUgxdg+AZMcdkw8BixyN/HxMTEpKens9ONRuOmTZvMZrPNZuvu7n6UKjU0NJjN5gMHDnz++ec4UXjt5ueff15RUWE2mxsaGgSE/PGPf2xra8vLy5uZmampqXnjjTdwFppAf+iwFSPCGFuSJEUiUV9fn81ms9lsdrvdZrMtUBM0AUJf3Ts5OZmQkEAvIxKJMjIyMjIy0tPTGQOCsxCca9a/9a1vNTY27t+/3+/389XduHFjc3MzmuMlCEImk5EkiV4rIgKBgEwmYyicmJiYkZEhkUhQlrDYkD0VaDTMHnGSkJAgFotjY2NDlsTQrz5OiyVYls9nw1EyYILHhoHHiHn4GJVKJZFIvvjiC/TT6XRqtVqVSiUSiYaHh3HiwnW6e/euz+f75S9/+fTTT2dkZOD3FiqViiCImzdvop8ul2vhbbGpra11uVwqlUqv16Ov1mdnZy9dusTnY15//XW9Xp+WluZyuWpra/mEIJ555pm9e/fW1taeO3eus7OTIIjExESFQjHfL6hJkqSPw5o1a8JUjG9s6aSnp8tksrGxMXwP5fwfMC8SExPVarXFYsEpaNnYAsUyqKqqWr9+PecbJgz6042OU1JSFApFT08PzjWbzXl5eVhhq9WKs65cuYKyhMWG7KlAo5H16KHAabGcls+w4egZMMFjw8BjhvBjzuTkpFgsdjqd6Fl43759JSUlHo/H4XDk5+c3NzdTFLV9+3aj0eh2ux0OR15e3rzmyiieJfMqlaq1tXV8fNzlchmNRlzeaDRu377d6/U6HA69Xh+NuTJ6emlpKUVRZrM5NzeXnk6vXlpaipaNcoKFDAwMFBcXo48tPB7Pvn378HrWxsbGwsJCu93u9XrRX7aQc2UEQdDHob6+HmUFAgGxWIxmrvkUY48t4yxTFFVeXl5UVORwOHw+36lTpxoaGjgnMejNeTwexhwRA/zViN/v//DDD0N+NcLI4vs+hv3yQy6Xc34fQ5LkwMDApk2bDhw4gMu3tLTk5OSYzWb0EYxCocAfweDvY0ZGRi5evKhQKKxWazhihXsq3GjIHuFi7JRwVv0ODg7iioFAAH1Jw5CDLJZiWT6fDYdjwNSDF2A4BkyFuriAx4IQPoaiqMOHD8tkMmSLgUBg//79SqVSo9HU19ej6/z27dsGg0Eul2u12pMnT87Lx/BdGGazuaCgQCqVpqWl1dTU4PJer/e5556Ty+U5OTmnT5+Oqo/BHDx4sK6ujl4+giX8MzMz9fX1OTk5EolEpVKVlpbevn0bZQWDwbfeekupVEqlUqPR6Pf7Q/oYuVx+8uRJlUqVlJS0Z88evMCBoqj6+np8vjjhHFv6WaYoiiTJ6upqjUYjk8m2bds2NDTE12vcHEmSUqlU+MUsumtLJBK9Xt/d3c3XQQbolsQAvfzgrHX27FnGO3+MSqXav38/Xu6BePfdd7VarUQiyc3N7ejoYCiMsvLz8+mfvIQUK9BT4UZD9ggXi8zHfPTRR3l5eWFWYVg+nw2HY8AU6wKM2ICBx4vQPmZeOJ1O/Ppu2ZCTk9PT07PYWvw/kTm5R0BlZSX9/TCw1CBJUqvVtrW1oZ8hDSlKlr9kDRiIBuKHO/Nms9l0Ot3DlbnoXL9+fbFVeDw4ffr0wlcHANEjNjb24sWLP/rRj3CK8Mc0YPnAwnkIPubYsWNqtbqkpGRoaKiuru7o0aMLlwk8jqxcufJ73/veYmsBCEF3MGlpaU1NTYuoDPAk8BDWLv/kJz9pbW3VaDSlpaWVlZV79+5duEwAAKJNbGxs9NYcAwDiIfiYjRs3fvLJJ9PT0zdu3Kiqqlq4wIUQZsD/6enpl156iRFp/O7du7t37161alVGRsabb745PT1NEMT169e3bt2amJiYmpr66quvsmN7bN269fe//z1unRF0fevWrbjk119/nZ6evvD5h8zMzK+//nqBQgBgsQADfqJ4Evcom56eLi4uZsdb3LNnj1QqdTgcZrPZbrcfOXKEIIht27ZpNBqn09nf30+SZHl5Ob3K9evX+/v79+zZg1MYq2y7urpwVnNzc2lp6dq1a6PZOQAAgKXEYi86eMiEXIiMyhw/fpwdGUkqleJITb29vdnZ2SRJNjU14TWpdrtdo9HQRR04cADvGkIJLpiZnJzMzc1lrJoFAABY3oS1DyY7CjfBEyKeL3w9O/1nP/vZO++8g3KvXbsWGxuLp6Fee+21Q4cOce4jwBkznDPgvwCZmZlvv/02IzEuLu6bb76Ji4tDP2dmZiQSSWxsbFVVFZpSu3///sWLFzdv3oyrTExMfPjhh4xvsOfm5qqqqlJTU1NTU998800cMqSlpeXgwYOPfgNNAACARST0XBlnFG6CJ0Q8X/h6drrBYMB7vl66dGlubu7y5cvop8lk2rZtG+c+AgRXzHC+gP8L4fjx4/QZsD/96U8ymay3t/e9997DiW1tbQaDITU1lV5xampKLpc7HA6r1WoymdC6nXv37r377rsNDQ0ZGRlvv/02PVYVAADAckb4MUcgCjcdFCKeL/Q3Z7rP50PBASmKKiwsrKmp2bVrF2oxISGBJEn2PgJYH3rMcL6A/1SojQME5rXq6+u3bNlCDyU7NTWF4mqcPXsWJ+p0OpvNRp+dI0mS/s1aZ2cn2n/w9OnT6PvnwcHB3NxcFIMHAABg2RPax/BF4eYMv88Zvp4vXa/XX7ly5fbt2xqNZnx8XKVSBYPBtra2n//855z7CFBcjoEv4D/Fv3EA7hqnj+ns7NTpdH6/n53V3d2NNq+laDHPBd4AOZ1OpHZOTg72gl1dXZx+GgAAYPkR+boyzhDxfKG/OdO3bdtmMpkuXbpkMBgSExP1er3ZbEYTZQt7Nvs/+DYOEODTTz8tLy/v6OhYtWoVQRD379+/evUqztXpdD6fDx03NzdXV1eHFDg3N/fVV18NDQ2tXr0apeTk5GAhAAAAyxxhF8SYK+vs7ET/wUdGRuhbBtlsNvZ/eZvNxliFxUi3Wq2FhYUlJSUoaGBra2tlZSXa94xzz02K6+GDMVfW2dkZcl0Z7hp7O6/s7Oz29nacQpKkWCzGU3NdXV1o7ouiKIIgFAoF3gYRbedlMpn0ej2u3tHRUVhYiLZjwX3p7OxEfQEAAFj2hOVjOKNws0PE84X+Fghrr1KpVCoVeivj9XoTEhLwPZpzHwHOCS7OgP8IgW0BGaKCweCWLVsqKyvpX7dQFGUwGHbu3On1em022/r16/FetngPxJ6enoSEBHQ8Pj6uVCqPHj3q9/v7+/vxqxej0VhcXOx2u+12+/r168+dOxfqvAAAACwHwtprmTMKNztEPF/ob4Gw9rt27dq+fTturqCgAMcS59xHgNPHcAb85yvM6Br9J+MJD8kZGRnZuXNnUlKSRqM5fvw4pxy6V+vr69uwYYNcLtfpdKdOnUKJfr9/165dCoVizZo1J0+eFB5zAACAZcMKiqIEZtKGh4dzc3Mh8AMAAAAQAU9iLBkAAADg0QA+BgAAAIgW4GMAAACAaBHCx8wrCjcKJhaxKozqExMTJ06ciGqLj0wmAADAk8kSeo7JzMz0+/345/j4eGNj4yLqAwAAACyQJeRjCIKIjY1dbBUAAACAh0ZoH8MOy8+YTWJsPfmb3/yGsREAKn/mzJmsrKy4uLgXX3xxdHT00KFDKSkpq1atevnll+/du0c8OEk1MTGh1WoDgcCKFSs++OCDCDrGuTUAQRBffvnl888/Hx8fn5WVdebMGYFNM+lqJycn7969m70JJgAAACBAaB/DF66fk0Ag0Pc/6BsBBAIBm81msVhsNpvP51u3bp3f77fb7T09PW63u66ujiEnMTHR6XSiPSVLS0sj6Bjf1gAVFRUSiWRwcNBkMl24cEFYSCAQsNvtVqu1t7fX4/Gw9QQAAACEEP5EkzMsP/sLefShO99GACh9fHwcpVssFpFIhOMFWK3W7OxsTrH0n5yB+vm+5OcLd4aCm+F0+kYAbJlIbbxzpcVi0el0QoMFAAAAPIhY2AMlJydv3769qKho8+bNarW6oKDgxz/+sUB5qVSKAwyvW7fO4/GgY7lcnpiYiI41Gk1CQsJTTz2FfqrVavqrfj7UarXVag1ZDDEyMjIzM5OVlYU1QQ5jZGRkbm6Oni4sRy6X4+k7jUYzNjYWpgIAAAAAEc5cGV+4/kdMBIH6AQAAgMUlrHVlzzzzzN69e2tra8+dO9fZ2alQKKampvB3M16vF5ckSfLmzZvo2OVyrVmz5qFrHA4qlUoikXzxxRfop9Pp1Gq1KF0kEg0PD+P0RVEPAADgCSGEj/nss8+2bt36z3/+c3R09ObNmy0tLXq9Pj4+vqCgoKam5s6dOzdu3Dh8+DC9Sk1Nza1btz799NP6+nqDwRCxZkqlkiTJGzdu4JTp6WnOktMPMjs7GxMTs3Pnzurq6ps3byJNdu3aRRBETEyMwWCorq4eHh5G6RGrBwAAAIQkhI/Jzs4uKioqLy9HL2NIkmxrayMIor29fWhoKDs722g07tixA5eXy+WFhYX5+fkbNmzIy8t76623ItYsLi7uyJEjer0erV0eHh5WKpXsYoFAQPogSMOmpqa0tLT8/Pzi4uKSkpIDBw6g8i0tLcFgMDc312AwIMcDAAAARIkQsf2XN9evX9+0adOdO3cWWxEAAIDlydL6zv8RY7PZdDrdYmsBAACwbAmxdnn5cezYMbVaXVJSMjQ0VFdXd/To0cXWCAAAYNnyxM2Vffzxx9XV1Q6HY82aNRUVFVVVVYutEQAAwLLlifMxAAAAwCPjiX4fAwAAAEQV8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtAAfAwAAAEQL8DEAAABAtPgv7wIzay/KsUAAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAANjklEQVR4nO2dbUxb1R/H78rCCrvlse222jmYOhdj3MyIYQYfspgNa7Mgcw/R6mZcMDFswSYuc8ZZXXSTifEBcW9Mtr3QxBhCCDGLwZggIQubWJExBmRSHgrD0q2u4B0B+n9x8785tufee/pwacu+n1e9t+ec38P5paecQ793WSgU4gAAAAAN0CXbAQAAAEsWrDEAAAC0AmsMAAAArcAaAwAAQCuwxgAAANAKrDEAAAC0AmsMAAAArcAaAwAAQCvU15hlNAwGwyI45/F4FsGQnBXpPtkgrHEgEDh58mQ8VuR48803s7Kyzp07x94lKjweT35+fgIHJFMR88TFM+OLUy2JhTrLCckkAKlCSA1BEARB6Ovry8vLE1/39/fzPK/aMX6GhoYWwZCCFUEQIhuIN2PwkOyojM/n0+l0brd7bm6OsUu0DA0N5eXlJXZAKRUxT1ycM86e4VRAbpYTkkkAUoTlqovQihUrOI7T6/XS68zMTK1XvhRBjJflZsyjUQkGg9nZ2Zs2bYrN0F1LzFOTFDDL4G4g9vOYzz//vLi4uLCw8OWXXw4EAtL9O3fuvPbaawaDYd26de+99978/DzZa+/evR9++KF0uXXr1k8//ZTcDZDbwxE3Derq6oqLi/Pz81966SXJKNWi2P7kyZMmk2nNmjXffPMNx3GXLl3aunVrVlaWyWTavXv32NiYNP7HH3+8atWq/Pz8/fv3//vvv5zMNgV5MxAIFBUVBYPBZcuWnTt37quvvtqxY4fU8p133tm/fz+146VLl5544gmDwXDPPffs2rXr6tWrpImpqSlyWI7jpqenX3/9dZPJtHbt2vfff39+fj7MNzJpCokaGxvbsWOHwWB48MEHv/3228gkK9iiDigRlgrxJrVClMuDxR+O48bHx5977jmDwVBcXFxXVyfGHrmlqeyz2Ob06dNh887J1AnVKGNEkVFEzrLWmQQgKcS4xgSDQbfb3dHR0dnZ6fV6jx49Kr31wQcfzMzMdHd3X7hwoa2t7cyZM2THPXv2NDU1ia/Hx8fdbvf27dvZjXZ3d4tGh4eHjx07pmwxGAz29fX19PScPXu2rKyM47iurq6qqqqJiYmenh6r1VpdXS21vPx/urq6amtrWfzJzc3t6+vjeV4QBIfDUVFR0dbWdvv2bfHd5ubmyspKake73X7gwIHh4eH29vaysjLxb0SJwsJCcliO4w4fPuz1eru6ui5cuNDc3NzQ0BBboqqrq3Nycnp7e3/88Ue5NYZqS25AuVRw8hWiXB6M/lRXV2dmZg4ODra2tp4/fz6qJIS16ezsjJx3ap3IGWWJKDKKyFnWOpMAJAfGPTVy+35oaIjjuH/++Ue87OjoWL9+vdTSaDQGg0Hxtdvtfuyxx8hxZmZmcnJyhoeHQ6FQQ0PDzp07w3acwwyRG9Ok0fb2dsko1aLY3u/3y0U0ODi4evVqqaXoUigUamxsLCkpIa0r7I+HXZaWlv7www/SferJjd/vX758ufLJATns3Nwcz/PXr18XL5ubm0tLS5WTRk3U3NycXq8nw4w8j5GzJZd5OZ8VKkS5PMLiovojBiLdlAJhrBbSFnXewxDrRM6oakRyUUQGS01CzJkEIEVQP4+hwvO8tC9hsVj8fr/4+ubNmz6fr6ioSLxcWFhYvvw/JrKysmw2W1NT06FDhxobGw8cOBCbUavVKhpVsMjzfNi22++//37kyJHe3t7Z2dmFhYWFhQXxvl6vX7t2rfh648aNw8PD7F6RVFRUtLS07Nq1q6WlxWazUY8H8vPzX3jhhdLS0m3btlkslpKSkqeeekphzMnJydnZ2eLiYsk98XNHAWqiJicnOY4jw2S3RR2Q3QepQlTLg8WfycnJhYUF8qaqA3I+y817ZJ3IGWWJKIYZlAsk5kwCkCwSXJeCIOh0usuXL0sVr9OFb8ft2bOnvr7e4XB0dnY2NjayfGDFaVGioqLi4MGDZ86c0ev1o6Oj5eXl8ZiOpLKyUtyUa2lpUVg+v/vuu99++62np8fr9Tqdzscff/zLL79MrCepSVSTlUTY6yRZEaVLJgFI8BqzZs2a7Oxsv9//6KOPyrWx2WwHDx48f/78M888I35Bm5mZuX37tvh6dHQ04RZF/v77b6/X++6774qXPp9PeksQhJGREfErbX9//7333huVDxIPPPCA2Wz++eefL168+P333yu03LJly5YtWziOs9lsdrtdYY0xm82ZmZl//fWX+EW4r6+vqKiooKAg2qSZzWaO48gwGW2pjswO+2Qp+GM2m3U6ncfjWbdunXgzZn+o806tEzmjLBFpkdVoMwlAskj8dx+Hw/HGG29cuXJlfHz89OnTJ06cCGuwYsWK8vLy48eP79u3j+M4g8FQUlLidDpv3LgxMDBA/vtAQUGBIAjXrl1T/p8ZVYsiJpOpoKDg66+/DgQCAwMDLpeLfNfpdI6NjV25csXlctntdvItBTeMRqMgCAMDA9KdyspKp9NZVlYm99O5q1evPvvss7/88svU1NTIyEh9ff3mzZsVosvIyNi3b19NTc3IyIjo3osvvqiQNIVxysvLyTAZbamOLBKZCirKkxWWaqo/GRkZdru9pqbG4/HIBcJO5LxT60TBqGr5RZvVhGQSgFSB8dxG7ig+7K1QKCQIQk1NjdVqzc7Ottls0lEnSVNTE8/zMzMz4uXg4OC2bdt4nn/ooYe++OILcrSjR49mZ2efPXtWwSjVIvVAta2traSkRK/Xr1692ul0kmfFtbW1ZrM5Ly/vlVdeER0jR5BzIxQKuVwu8S3x0u12cxwnXZIOix1nZ2ddLteGDRsyMzPNZrPD4ZiYmJBrLBIMBquqqoxGo9Vqdblc4k/25JKmkKjR0dHt27fzPL9hw4ZPPvmE+hvMSFvK001NRbSTRSKlWiH2iYkJu93O83xRUdGpU6eoZ/6qPottTp06FTbvIZk6oRpliUguCoXfVyYkkwCkAstCoVCyl7klxfT0tNFo9Hq9iVVqAXJcu3btySefvHHjRrQdPR7Pww8/LP2v+eIYBeBuA+eECeann34qKyvDArNouN3u9evX3w1GAUhH8P+OiSQQCNTX14vnTEA7Tpw4YbFYdu7cef369WPHjh0/fnypGgUg3cHfMYlE2tlPtiNLnKeffrqhocFqtTocjsOHD5OaPUvMKABpT/xHOtEq+LJIybK0uXXr1kcffcRuN7Jj+oraLpqwMZnkeNKVrL6pQ8zlCkBak4Azf4/Hs3nz5ps3b7J3uXPnjqpErmqbmM9syY4snqQg8ZxXRxUyaSgeo/H05dJ2mkjizAAAaUpy9spYPi8W5zMl3T+5YiAdQ05HnwEAHMsaQ9U5p6rEk4LqK1eu3Lt379TU1FtvvWUymQoLC1999dXp6WmOTYM9TLs+Ugw/TAKdXcmf7Bj2WAGqjDyLSvz8/Pzbb7+9atWqlStX7t69e2pqSm5A5dGomv9Ur8Jgl3mPSgCfXWc+Kh8UglIW7ddCsZ+xchhrWy4PkZlkfyAFAGmN+hojp3NOVYkXdcjb29vdbrfX6924caPP5+vu7r548eLQ0JCcvrqqBnukGD5VAp1FyZ/s+Pzzz5NW5CT0VT2sra1tbW1tbW3t7++3WCy9vb0KAyqMRtX8ZxH2j1nmXTk0dp35aH2QC0pVtD/hiv0cc+Uw1jY1D5GZZH8gBQDpTVSnN6TOeaRKvKgme+vWLfF+e3u7TqeTfjvd0dFx//33h9g02Mk2cmL4keOwKPmTHVUl9BU8JDGbzV1dXWE3o9XJp4bJKAvPLvMegwA+i868qg8sqVYV7U+4Yn+IuXIYa1shDyxTpuoMAGmH+u9jqDrnnIxKPM/zubm54mur1ZqTk5OVlSVeWiwWUoaS7KKswc4ohs+u5E9FQYBd2cNAIOD3+x955BHGAeVGo4bJIgsfj8x7tKL9MT/TgUQuKBbR/sQq9ktjslQOS20z5iGqB1IAkNaofxhprYfPQmxi+IvpeUZGRvyDRIZJ3QsKIxVk3lPBB1XY6yHmymHMQ1qkC4CEoLLGyOmcc2oq8QmHXQxfREHJn0rMAuy5ubkFBQV//PHHpk2b4h8wLMzPPvtMdZBUkHmPyge5zCRKtJ9dsZ9KtJVDwpiHVJgyABYHlW9PcjrnqirxCURODF9ZAl1ByZ/aMR5Z+5qamqqqqj///HNsbOzQoUO//vprDANSw5QbJEwDXzuZd0adeVUfSIflgkqgaD+jYj8V9pZU5PIQlkko84O7BdUTG6rOOVUlXllQXbpk0WAn7yuI4ctJoCt4Tnasq6tTldBnUYmfm5s7cuSI0WjU6/UVFRU+n09uQIXR5MKkehX6rwY++9MNohXAV0hytM90IB2WC0pZtF8LxX7GymGsbeU8kI+BYJ8yANIaaPsvWdL9h+Wx6eene9QALDFw0riUSeyTkhcZ6OcDsASAtv+Shef5pqamZHsRHdDPB2CJgb9jliyFhYX33Xdfsr2IDujnA7DEwHkMAAAArcDfMQAAALQCawwAAACtwBoDAABAK7DGAAAA0AqsMQAAALQCawwAAACtwBoDAABAK7DGAAAA0AqsMQAAALQCawwAAACtwBoDAABAK7DGAAAA0AqsMQAAALQCawwAAACtwBoDAABAK/4H+yuUrCiNhO4AAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 13 January, 2020 15:46 GMT
Vulnerability Verified: 13 January, 2020 16:31 GMT
Website Operator Notified via Bug Bounty: 13 January, 2020 16:31 GMT
Public Report Published
[without any technical details]: 13 January, 2020 16:31 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 12 April, 2020 15:46 GMT