Lucene search

K
openbugbountyFakesshOBB:1087175
HistoryFeb 07, 2020 - 10:31 p.m.

simdp.ru Cross Site Scripting vulnerability

2020-02-0722:31:00
fakessh
www.openbugbounty.org
5

Open Bug Bounty ID: OBB-1087175

Security Researcher fakessh Helped patch 1840 vulnerabilities
Received 9 Coordinated Disclosure badges
Received 60 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affectingsimdp.ru
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: simdp.ru
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **fakessh Helped patch 1840 vulnerabilities
Received 9 Coordinated Disclosure badges
Received 60 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAX20lEQVR4nO2df1BUxx3AN+cJ53H8Pp54ED1oJMax9EIchqQ0pYw1llzNxTIJJVdDqDWUWkoYpAzN2KthDEF0LCWZjEM6mHHoj8lkHMfJOA4xqWWsoYQgIrkgPfE8jyucCHji4zx9/WOnOy/vx967gwOTfD9/3f767ne/u+/tvd193/cAx3EIAAAAACKAaqkVAAAAAL62wBwDAAAARAqYYwAAAIBIAXMMAAAAEClgjgEAAAAiBcwxAAAAQKS4L+aYjIyM8+fPywUBOcBQAADc5yz9HHPhwoV79+595zvfkQwCcoChAAC4/wkyx1y5ciU2NlYyaXp6+vXXX5cLKuf48eNbt26VCy4VlIYrLJ6YmLiA+ohZfEOFYZMbN2689NJLKSkpaWlpv/3tb+/cuSMnRInFLl++/MwzzyQmJq5cufIXv/jF9PQ0jv/HP/7x6KOPxsTEPP744xcuXJhnW4JqMjEx8cILLyQnJ6elpb3yyitzc3N8gfziN2/e/M1vfrNmzZoVK1Y8/PDDb7zxxt27d3ES/XoJe/hJqjF/BPrwlZ/nlcLnlVdeWbFixZEjRxZEppwFwr5TAWHCURkdHdXpdEqSKDnp5Obmnjp1Si64hLAsG3bZ0dHRhISEBVRGzOIbKowu3rp1a2lpqcvlstvt+fn59fX1nIxhlVhs/fr1dXV1Ho/H4XBYLJbS0lIcn5qaeuzYscnJSZvNtnHjRoW6yfVvUE22bNlSXl7udrtHRkYKCwtra2s5nnH4xYuLiy0Wi91uHx8f7+rqKigo6OnpIbVQjBn21SSpxoLAN5dAvflcKQSv16tSqfr7+wOBwILIlLNA2LYFwmOJ5xi3252QkOD3+yWDX10iPccsiaFC7eLZ2dn09HSfz4eDPT09Dz30EEU43WLj4+NqtZoE+/v709PT8W+9Xu9yuTiOO3HiRHZ2tnINw9DE5/NpNBpxo1wuV05ODv6Rm5vLcdzs7KxarZ6ampKrJRJzjFiNSBCJ2/SCy4Q55j5B0X7MH//4x4yMjOTk5J/97Gd4gWJ6etpoNPp8vgceeODIkSP84MGDB2NjY/fv379y5crExMQXX3zx9u3bcpKPHz++efPm5cuXC4LPPvvs/v37ceT58+ejo6PJwsjLL7+8du1aSuru3bvpxXfv3s3X4d///vf3vve92NjYtLS0n/zkJ59//jn68ppDbGzsgQMHMjIyYmJinn/++evXr+/evTslJSU5Ofmll166desWlnPt2rWnnnoqNjb24Ycf7uzsxJG4ON0aOM/rr7+ekpKyatWqd955R7BWIH7q59ttbm7u5z//eWxs7Jo1a37/+9/fvXuXr3NiYuILL7xAmo8QGhsbe/rpp2NjYzMyMg4cOCBeT6DrLB4McvlXrFhx9erVmJgYXHBkZMRgMPCbJmkxOVJSUrKyst58802E0O3bt99+++38/HycVFlZWVRU9Ktf/aqhoUEgR043gYWVaxITE3P79m3SKL/fHxUVhRBKS0v79NNP8Y9PPvkEIXTv3j2EkFqtFgvhXy/bt29/6qmnSNLvfve7F198UZBf3MVy6onVoPTmrVu3Xn755ZSUlAcffPAPf/gDESu+IvjmElz7/CRJgfTRiLl+/bqkzMuXL8fExHz22Wc4T2Ji4kcffUSxSdB+FChP11nhTQwIAn0KGh0dRQiVlZWRlYGKigqcZLfbdTody7L42ZYEHQ4HQqi4uNjpdI6MjGzYsMFms8nJLyoqOnr0qDjY3t6+efNmHNnY2KhWq//617/iYGZmZm1tLSX19OnT9OKnT5/m68AwTHt7++TkpMPhOHjwoMPh4L685oAQslqtLpdreHg4Pz9fr9djgwwPDxcUFFRVVWE5FouF32r8HwoXp1sD59m+fbvH4zl58qTdbhc/Iwr+kfHt1tDQUFJS4nA4hoaGCgoK2traiECsZH5+fmVlJSm7bds2i8Xi8XhGRkays7PF//XkdJYbDEraaLfbDQZDT08Pv2mSFuM4Ti8Cxzscjri4OI1Go1ar161bRx4mmpubdTqdVqt1u93K28K3cKiaELZs2dLU1MTJsHXrVrPZ3N3dTVTlGwRfL06nU6PRzMzM4PgNGzYcO3ZMoJ64ixWqR7EAx3Hl5eVms9npdA4ODubk5LS2tuJ48RUh0Id/7fOTJAXSR2NQmY2NjU8++STHcZWVlWR1VM4mcv0oVxFdZ4U3MYCOojmGXABnz57NzMwkSZJrZbiI0+nE8e+//z5ZInc6nUajkRTx+Xw6nW5yclIcdLvdWq0Wr8nm5ubW1NTg4TU6OhoXF+d0Oimpfr+fXpy/xDQ5OalWq8WLv4LmkBWP7u5ulUo1OztLDIKXSgKBgEaj4beaP8dIWkNgZGIHSdvyrxaB3fR6PbmF9ff35+bmCnqtu7ub9BrWE8+jfD3F+oh1lhsMQdvocrkyMzPxNE+aJmcxnF8Ajq+qqsrJyenp6Tl16lR6enp7ezvHce3t7dnZ2R6Pp6CgYMuWLRzHjYyMMAwTtC3EwmFogrHZbJs2bcK3KklmZmbq6+uzsrLUavVDDz1ks9lIZr4CeXl57733HolkWVYwAMRdrEQ9ugUCgYBOpyMj4fjx43l5eZzMFUFZGOd3qKRAymjk3xAkZXIc5/f7161bZ7PZ9Hq9x+Oh2ITSj3IV0XVWchMDghLafgz/ZkeZYzQaDYkfGhoiF3wgEOD/03z//fcLCwvlgiaT6fTp0x6PJz09fWpqimGYQCDQ3t6+bdu2oKlKMhBKSkpMJlNNTU1LS8vHH38sbg7ldk+Cbrdb0Goyx8hZQ87IQSvlG2pychIhRP7GJiUlMQxDKe52u6OiosR6CmqX1FlObNA25uXlkf/IRIicxeTw+/1arXZgYAAHOzs78WXPMExfXx8WqNfr9+3bd+7cOZPJpLwtoWqCOXbsWGZmptfrDZqT4ziWZc+ePZuXl/fqq68SxYgCTU1NZWVlHMe1tbU999xzglTJLlZSKalI0gKCkTA8PJyamop/i68IJXOMnEDKaOTfEOTmGI7jurq6EEJkCMnZhNKPchVRdFZ4EwOCIrFYHDmWLVu2atUqEqSfWi4qKurq6nI4HGazOT4+3mQynTlzpqurq6ioKGiqkgyEv/zlL59++ung4KDb7a6pqXniiSf+9Kc/RdAK84ZvKJZlVSpVb28vWfdXqVR+v3/ptBMyNjY2MDDwr3/9S3mRlJQUQczExMTk5KTf7//2t7+NY0wmk8vlwvGPPvooQmjVqlUdHR0Wi6W3t5ds1cwTSU0QQhcvXqyoqDh58mRycrISOdHR0Y8//nhra6vVan3ttdcEqdu2bcMKnzhxoqysTJAq2cV09eaJ+Iqora2dv1gxghuCHB6PR6VSeTweEkOxyXwqUsICivqGEJE5hmXZq1evPvjggwih4eHh1atXi/PcvXv3xIkTe/bskQwihMxmc3V1dWpqakVFBULIYrEcO3bs448/PnjwYNBUJRn4PPbYY4899hhCqKioyGw2hzHHMAyDEOK3OiRrCEhKSpqdnb158ybe+XS5XCRJYKhVq1ZptVpyn8VcuXKFoqdKpbpy5cqaNWsQQna7XTJbqDpT8jMMMzg4KKkJkrFYf3+/OP/KlSvVavV//vOfb33rW1hzo9GYlJSkVqsvXbq0du1ahNDTTz9dXl5++PBhfo1B2xKqJjdu3LBYLAcPHgz6AuytW7fI6QCsSSAQEGdbu3YtwzAffvjhuXPn/v73vwtSJbuYop4YSQswDBMVFXX58uWMjAz0f3uSIoIrQskcQxcYNtPT07W1tZ2dnZWVlVar9ZFHHkEyNsHb9ZL9GIbOYVy2gDT0xxzKc67P51Or1cPDw4Ig2S5zuVyDg4Mmk4m/XUbWec+cObNhwwYSLwhiGIZhGAYXcblccXFxZA0kaGrQDDh+aGhoy5Ytp0+f9nq9Tqdzx44dZrOZC32tjPv/fiNptWDPX2wNYgrJw5S5ubk7duzweDx4m5TUIjZURUVFXl4e/tfZ3Ny8d+9eus74pY3R0dHBwUH+nj9fH0mdKWtllB7n5F+tkLQYhV27dhUWFjocjr6+vqysrI6ODo7jKisrn3jiicHBQa/X29HRodfrU1NT+UtSStqiXJNAILBp06aqqiqWh2ROu93OMMzhw4fdbvfU1BTuuH379uFUweWzZ8+e7OxsPPY4jpuZmVGr1Xa7He/fiLuYbig+lN7ZsWPH1q1bBdvdkleEwFx85flJkgLpo1HyKuD/rqysxOuHjY2NBQUFpKCkTeT60efz4dEitryczkpuYoASwp9jOI6z2WxarZZ0Hg4eOHBAp9M1NTUxDJOQkLB9+3ayQ86XVltb29DQQEQJgpjS0tLi4mIS3LhxIz8PPZWegWji9/ttNltWVlZUVBTDMFarFe8rhjHHuFyuzZs363S6rKyslpYWcv+VtAZl9RmDD27pdLr169e3traSWsSGYlm2uro6PT1dq9UWFRWJTwEJdPZ4PGazWafTGY3GpqYmvp58feg6c1+eY+R6XNJiRIikxSiwLLtr1y6GYVavXt3S0kIi6+vrjUajRqPJyck5evSow+HQarVnzpxR3hblmuC7Dx9K5g8++KCgoCAuLk6r1WZnZx8+fJifyr988BMJuZQ4jquvryep4i6mG0qgsFzv+Hy+nTt36vX69PR0ch5B8ooQD1GiPD9JUqDCPV3J3729vTqdDu+9syxrNBrfffddnEfSJnL9KNCBb3mKzkFvYoASgswxYaCwD7Kyss6dOycX/Nqw4CNyYQ2F/2sLIkPV+X6+6u5n3fjgVzv5ZwsXiq+KBSLK12lIf+VY1D1/Pl988QUlCMixsIbq7+/PzMxcQIFAeJw6dSo/Pz/SPu6+yYgPUwCLw9L7XQYWmddee+2dd96ZmJj45JNPGhoa8JkIYKE4f/78L3/5y5CKTE9P41PLEVJJwJ07d37605/+97//JTFBdRYX+WqRmpp66NChpdbiGwrMMd84CgoK3nrrrfT0dKvVWlVVJfZcAsyHsrKyUM9TkUX/yGgkZPny5VFRUfyjYkF1Fhf5ahEdHb1s2bKl1uKbStDVNK/Xa7Va9Xq9wWCor68X+GFUvnBZXV2t0WjwPtvU1BQ5YBNSdWJRoUKpmsKCrM9OTk5ardakpCSDwVBXV4ebJhlJiQ8P/hEG/h51a2trZmZmVFSUyWT64IMPFIoig0elUhmNxr1791LedVdourD7RTykDx06tOAVydUusCp2HhyJc0d4zOMDNfOX1tfXR964FOvMsmxJSYmgIlJEbiwBgCTB55iioiLinp3/ojJG4R1E4LibUopenVhUqIQ9W8z/xoHd0btcrqGhoby8PHwaUjKSEh8ekveF1tZWo9HY1dU1Pj7e2dmZlJSEz2IpEYXP7M7OzmI3HvTTtEpMF16/8JUh0AfGAm7niq0aob1i/phfkAmMcqyRZdmCgoLi4mI53xMwxwAhEWSO8fl8KpWK760rKyuLn0HhRUXxRRFSdcprVKjJosGyLN/Te3d39/r16yUj5TLPp3ZJl+8Gg4HvHvTQoUPk/QwKYgPOXz1JsREqtYADQGzVCI2uBRdLmWNGR0cbGxvFNZKYxfl8APC1YV7vx4gzcBzHsmx5eblOp1u9evWePXsCgYDX6yXrGB0dHVNTU/xgSNUJRHHU4+0tLS1GozEhIaG0tBTfrylVE3p6evLz83U6ncFg2LZt29DQkEAxycVGcasFYqempvjONHt7e41Go2SkXGaiRnNzs+DYPn4jBLvt8nq9CQkJAt/SYrAp+EtwfX19AoenYgOK+wirh/8K0F+PoMgU9IukMXHxffv24bcssUNMuZuv8gGgvC4liPUJBAL19fUMw2i12uLiYuzfLKRByx/z/LUysZJ8CVqt9rnnnvN6vbW1tdijV1lZGXEiGfT1LMocAwAhsfB7/nv37p2dnR0YGDh58uSZM2fefvvt5ORk4k/barXGx8fzgyEJF4hCCFVVVbnd7r6+vpMnTx4/fvytt97COX0+38DAwNmzZ3t6epxOZ0NDA0JISdVms7msrMzpdHZ3d+fn52s0GkEGsiZTV1dXUlIi12pBqfj4+JycnIaGhjt37ty8eRN/sVEyUi4zaVdPT09vb29vb29fX19zczNCKCMjo6Ghobq6GiG0Z8+eoqKiH/zgB3RL4hcyyJd7EEJxcXEzMzP8DGIDipmYmHj11VctFgulL4LKFPSLnDF9Pp/dbh8cHOzo6AjqkUzhAFBeV4oIugKY5ubmrq6urq6u4eFhg8EwNDREMZSkzvwx/+yzzwraKFDS5/P19/d3d3f39/e73e5169Z5vd6BgYFz586Njo7KdSIARBD6FCT3YEEcXIv/3Uj6Iaeslcm53ZasTpAnDHfi9L9jQV39EwYHB1evXk3c7kq2WuAGfGhoyGQyRUVFabVahBD+UrJkpFz8qLzLcUkX6BQ/5OIWORwO/nvRFAOi/7u8TUpK0mg0FRUVeBdEri/Ic4ycTIE+ckMIffkLCAJlMLt27QqqP7/hyutS6EhfYFXiFpown0EreP5Aok9CIAXfoRDLgecYIHKE+Q6mwWA4e/asOP7GjRter5ecg7x3757kdwCViFKSZ3x83O/3Y392CKF169aRg0Y6nY58ni89PR07AxfD/zc6MTGRmJhYXFycl5dXWFhoMBg2btz4/e9/X7Lgzp07W1tbsdtduVYL1H7kkUc+++yz6enpP//5z52dnT/84Q/lIinxGo0G++nD7XU6nfj38uXL29raNm3a1NraunLlSrrdEEJqtVrgn1HQWRQDarVa7PtEpVIxDINPhY6Njcn1hRKZBMoQ0ul04rcUiTIkGKG60tLSxBLoTE9PT05OZmdn8yPnP2gJYiV1Ol18fDyREBcXt2LFChw0GAz8ZTcAWBzCnGPkHFyH6nObIirUPOEh9lyrxNX/m2++mZmZ+cwzz+CgXKsl1dZqtYcOHWprawsaSYmXROwCnWI3vPZy584dslw2MzMTFxenpCKVShXGDVchoQ6h+SgTUl1hO9KHNzOAbzJB5hi9Xj87Ozs9PY3/HLlcLuwIXQ6KH3IlhFrd/N2JS96e6K7+r1271tbWxn8+CKnV2Dfwj3/846CRkvFyLsclXaBTiI+PNxgM3d3dZOcGHw8Lqr8cC+XafZ5DKHJ1KXSkzyc+Pj4pKen8+fP8rwBEyAc+ANyfBHnIiImJ2bx5865du8bGxi5dulRfX489Xty6devIkSMIoaSkJJZlv/jiC/zxBoSQ1WqtrKy8ePHi2NjY/v37xV9kQgjp9XqWZS9duoSDc3NzCqsTsGzZspKSkurq6qtXr168eNFms5WWltJbJKhawOeff/6jH/3oo48+un79+tWrV9va2kwmkyBPVVVVY2OjVqudm5sjmsu1mmTA3L17t6mpyWazBY2kxNfU1Fy7dg2312w248iGhoYnn3zy+eefr6mpqaysxJFydsPU19eXl5d/+OGH169f/9vf/maz2erq6uQyByWMvuDD7xclQ4jP3JchQzFoRSHVlSZCnEelUglWIKurq3fu3HnhwoVr1679+te//uc//zlPQy0IgUCA/+gm+VUbShEACIGgOzbj4+OlpaX4hXPy4j1/A5DvhJyT8bmt0De4kuoE+UN1J86JPknAJ6irf07+7LKSVr/77rv43YKgkZLxci7H5VygB92nlXvPn2JAikwlZ5clZWJIvyg0Jif/nr/yAaC8LiWwLKvRaMi3STiOCwQCdXV1er1eo9FYLJagZ5cldZbb86dvy4/Kf4fivffey87OltNZUji/CAAoJ0zf/ot8yATOtGBCtQPYbfGpqqoqLCxcai1o4H8h/Jd+guosLgIACgn/4XeRfWWDa+7wALstMi0tLWHs3Cwm0dHRR48e/e53v0tiguosLgIACnmAEy3+KGFubk6tVi/agZlFru6+5cqVKxs2bLh586bC/GA3AACWljCfY6KjoxdWj/uquq8NYDcAAJaWMJ9jAAAAACAo8I0yAAAAIFLAHAMAAABECphjAAAAgEgBcwwAAAAQKWCOAQAAACIFzDEAAABApIA5BgAAAIgUMMcAAAAAkQLmGAAAACBSwBwDAAAARAqYYwAAAIBIAXMMAAAAEClgjgEAAAAiBcwxAAAAQKSAOQYAAACIFP8DOUU37l+VJtoAAAAASUVORK5CYII=)

Cookies:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAT8ElEQVR4nO2df0wT5x/Hb9hhVwoC1hah8wcxSAgjhBDCFrY4Q1wlDWMMCUNkRNERwhiSzSkzjBhCGKIhjBC2EWPMgmYxpCGGEdM40xhiKuu6jjEkBCupTYMVK3ZYauW+fzxf73vf3j1P22uLKJ/XX+3T597P83mez93n7rnr516jaZoCAAAAgDAQ8aI7AAAAALyyQIwBAAAAwgXEGAAAACBcQIwBAAAAwgXEGAAAACBcQIwBAAAAwgXEGAAAACBcQIwBAAAAwsVLEGPu3r0bHR3NWx4XF+dz86WlpU8++YRRuHv37mv/z969e9FPd+7c+fDDD+Pi4hQKxeHDhx89eoQTIRTiym/fvr13794NGzYoFIpDhw49evSI25Pt27ejyg8fPjxw4MDGjRuTkpK+/vrrp0+fMjqPHz/evHnz7du3Cco4EUKLDx48OHDgwKZNm5KSkk6cOMG06KctBNtxygSRF44/rsW1VIBrBeRChHKKovbu3fvDDz8wX+/fv79//340+0ePHl1aWkLluOngFXkh4PZ3ATrkScQN0SohVOPwwnkJYszWrVvtdruwbZeWllQqlcfjYRdKpVIXi6GhIVSuVqtTU1MnJydv3rxpt9tra2sJIryFhPKCggKlUjk5OWkwGFwuV01NjVdPWltbMzIyUOWDBw8uLy+bTCatVqvT6dra2hid7u7uioqKnTt3kpVxIrgWKysrl5eXjUbjtWvXrl+/furUqUBtwdXnVSaIvBTgRiYg1wrUhXDlFEXdvn3bYDBUVlYyJZWVlWKxeHx8XKfTmUymkydPMuW808Er8kIIZn8PCNwQrRJWbBzCDv3SYjabY2NjfdZpbW01m81SqZQpYT6zmZubE4lEzFej0ahUKnEiuEJcucvl6urqWlhYQF9NJpNSqbTZbCqViqmTlpY2ODiIKotEIofDgcpv3LiRlpaGPi8sLKSnpzM6OGWcCK5Fp9MZERHBrpySkhKQLTjbccoEkdWAT9fCuURArhWQCxHKaZqura09efIk89XpdIrFYqfTib7q9fodO3bQ+OngFXnZIU8iboiAkCMwxvT09OzZs4f52tTUVFxcLJVKOzs7t23bJpFISktL7Xb7l19+KZPJ4uPjq6qqmOnkhbu7Mv7B/slisezZs0cqlaakpLS1tfmMMVwFs9kskUjq6+vlcrlcLm9oaPB4POintLS0np4emqYXFxdramrKysoIPSQUEsppmna73ceOHausrGQX6vV6mUzmdrtpmnY4HBEREYuLi+insbGxbdu2oc9tbW3nz5/HmclWJohwWyQMvgBbCBGdd7fnFSHA9b3KykrUkGD3owW5Ftc6Aa4VqAtxyx0OR3x8vM1mw/WTOU0hTIdPEV7CMRdendTr9Xl5eVKpNDExsbi4eGJiAhXm5uaKxWKZTFZSUmKxWFBlYccH+v/P5ARYHeTRj6bp0tLS1tZW5mtubu6ZM2d8joPT6Txy5IhMJlMqlS0tLcjf0AC2tbXJZLKEhIT+/n4/7QoTAmOMxWIRi8XMeWh6evpPP/1EUVRFRYXFYpmamsrLy5PJZFVVVVardWpqateuXfX19QRBP2NMUVFRSUnJ7Ozs9PR0eno6U0fGASduNpspimpqapqbm0MinZ2d6KeZmZmYmBixWCwSiVJTU73cIiQxZnBwUCQS7dq1y+Vysctra2vZ45Odnd3Q0OB2uxcWFtRqdUlJCU3TTqdTJpMlJycnJiY2NTUxxy+cMq8Ib4vCYgzOloBiDE6EANf3NBoNmlbB7kcLci2udQJcK/gY09nZSY7QKpWqvb2dt8OMmT5FeAnHXHh1Ui6X9/f3z8/Pz8zMnD17dmZmhqbpvr6+c+fOORwOm83W0NBQVFSEKgs7PrCHSJjVQR79aJq+fPlydnY2+my1WsVi8V9//eVzHA4ePKhWq2dnZ8fHx7Oysrq7u+nnflhZWWmz2UZGRiYnJ/20K0wIXyvLzc29fPky/dwnpqamKIpiX4azz6NHR0fJl6L+xBiPxyMWi2dnZ1H54OAgU8fCASfucrlu3rzJ/KTRaHJyctDn+vr6rKwsvV5/9epVpVLpFf9DEmMWFxd1Ol16enpfXx9T6HK5YmNjDQYDUzIxMZGZmRkZGSmRSCiKunr1Kk3TnZ2dRUVFdrsd7T/InwjKvCK8LQqLMby20AHGGK7I7Oys1yUXFy/fc7lcaL8S7H7CXIu7iijAtYKPMcnJyUajEbc01NLSkp+fzz7DZUsxm/CKvJC5YHdyfn5eJBKRzz+mp6cTEhLoII4P7CESZnWQRz+aphcXF2NiYlDne3t7CwsLfY6Dx+ORSqUo2NA0PTQ0lJubSz+PMfPz8+QWVwzhMaa9vb2qqoqm6Z6entLSUp/HKZ8L3D5jDArvTJ2JiQkBa2VeTE5OIgd1u90SicRkMqHygYEB5rSCICJgrYym6eHh4aysLObrpUuXMjIyuNUcDsfZs2eZbqSkpDD7z9DQkFf3eJW5IrwtCl4r420x0LUyLxGPx2O1WnHNIbx8zx8TyK4izLXII+OnawUZYwYHB3fv3k1jbNRoNMnJyXa7nXdbZhOcyAuZC6/Ny8rKMjMzGxsbOzs7r1+/jgoNBkN+fn5iYiJajEKCwibRa4iEWR2kyYyl6MQxPz//559/9jkOVqs1MjKSqTA1NYX8jeyWK4/w58qKi4uHh4cpirpy5UpxcbFgnZCwiYP/2y4vL1MUNT8/73a733rrLVSYmZlpsVhC1b2nT5/eunWL+ZqcnGy1Wpmv58+fP3jwIHcriUTS1dXV3NxMUdTDhw9nZmbefPNN9FNKSgpSICt7ifhsMXhbghdZt27d5s2byZuvpO+tctfq7u5uaGjg/envv/+uqakZHBzcuHGjMJHVMBcXL17s7+/PyMhwu92NjY2ff/45RVFFRUXvvfeeTqczGo2odTK4SeQdohdldWlpqUajefjwoV6vLyws9PqVdxxeDoIJUOnp6VqtNjY2dmFhIchIvrCwEBERwSxx3rhxw+damUajEbBWptVqMzMzmZ8GBweZBQ2xWDw9Pc2UowtPXhFyIbccPeXFXL0ODQ0xjaK13bm5Oa7Ijz/+yJzdu1yuiIgI5rpYo9Gg7hGUuSK4FsmPG/lvC7c+4bkysohP2L7H7WSg7ifMtbwaFeZaQV7HUBQVHx+PTucjIiKYmw3z8/M7duwYGBhgb4ubDpyIn4R2Lgin4eiRPO5zekgw0EnkHSJhVofkOsblcsXHx3d1dRUXF9N+jANhrWxVXccEFWOam5szMjLUajUdtGPRNJ2Tk1NdXW2z2dBNM8I9f4vFMj4+npmZKWCtzOFwyGSy5uZmu91uMBjYNzbq6up27949MzNjMBhSUlK8nuAKcq1MrVaXlZVZLBaj0ZiWltbb24vK29vbmTuWbDweT3Jy8tDQEFNSVFSkUqnMZrPJZEpLSzt37hxZmVcE16JKpaqoqEC3KPPy8tjPsPpvC299nDJOxOl0Ep6dY2D7HrdRAe4nwLW8GhXmWkHGGOagefPmzZiYGPTZ4/Hk5+fX19ez/6yD6vNOB68I/YLmgr35xMSESqW6du2a3W6fnZ2trq5Grcjl8t7eXofDMTU1VVRUxAj6P4mEIRJgdUhiDE3T5eXlMTExv/zyi5/jUF1dXVhYyL3n/+rEGKPRSFEUmo/gR3l6enr37t1SqTQtLa27u9vns8udnZ3C7seMjY2hpwCTk5M7OjqYcpfLVVdXJ5fLt2zZwjwRhBMhFPKWz83NlZWVxcbGKpVK9kOKqampGo2Gq3DhwgWv6w+73V5eXh4fH79lyxb2MzA4ZV4RXItzc3NIPDEx8fjx4+iZ5kBt4a2PU8aJ+LmHsH2Pu5UA9xPgWtyuCnCt4O/5M+XsXcZruYL5iTDRNN+4rfxcsDd3u90tLS0pKSmRkZFyubyiogI9Xa3T6bKzs8VicUJCQmNjI/t6xc9JJAyRAKtDFWM0Go1UKkUPC/gzDoRnl/1pbmV4jaZpwets//77r0wms1qt/uR0AQB/uHv3bnp6+uPHj8nVwPdWgLU5F2vT6vARVC6Zq1ev5uXlwRADoaWqqspnHfC9lWFtzsXatDpM+LiOwT1FMzMzs7y8XFxcXFZWdvjwYf/bIwi+GgnggCBZWloSiUTr1q0Lue9R4H4BsjbnYm1aHT58xJh79+7xliclJa1fv16tVg8MDKxfv97/9giC/osAa4GQ+x5ZM+D+rSXW5lysTatDT5ju86hUKuaf29zbaygzI/v2Y0NDA/Ncx/z8fEVFBSo/duwYk1PLS8Trv7jsFnlFcN14NSDfVxT2X1FhuFyusrKysN51XG13NdmsqYkAAJ+EJbc/N0m4lC/nOS63Ni6zvRSTl563RZ+Z7dmp14FQQcg/D6wkMBHAaiEcgcsrSTjvORoutzYusz0uLz1vi7wiq/nkN3hWyemzGZ9/PrStrNqpXFMTAQA+8X0d8+zZsxMnTigUiqioqH379j148IBc/9GjR5cuXaqrq2MXLi8vf/HFFwqFQqFQHD169NmzZ1FRUU+ePImKikIV3G53ZGQkRVEul2t5eRl9pihKLBYvLi5SFKVQKH799VdUeOvWrbm5ObVajWsRJ8LtBs6Kjz766PTp0+jzn3/+uX79eubdhZ999tlXX33lVX9paenQoUPR0dFbt2799ttvkfKdO3eioqL++OMPiqIePHgQFxf322+/odfbnT59WqFQxMXFffrpp0+ePGHsevvtt994441Nmzbt27fv3r17qPKZM2e2b98eFxe3f/9+9vsi792798EHH0RHR+/cuXNgYIAp5+qg8u+++47bqD+G+M/WrVu/+eYbbrlPL7p169a7774bHR2dlJT08ccf//PPPxTnVYBebzbkNQcmAiF4IgAgtPiOMR0dHVqtVqvVTk1NJSYmTkxMkOv39/er1WqFQsEuXFxclEql4+Pjo6OjWq22q6vLa6vW1la00rVhw4asrKympqanT58+fvy4paUlOzvbq/L58+fLy8tff/11XIs4EVw3uOmM1Gq1VqtFv165cmV5eXlkZAR91Wq1BQUFXl06derU4uKiyWQaGRnR6XR9fX0URW3fvr2pqQllgmpubi4oKHj//fcpinI6nXq9fmxsbGxszGAwdHR0IBGDwXDkyBGbzTY+Pq5UKlHUdDqdJpNpdHRUr9fPzs42NTUxjdbV1cXExExMTAwPD7MPbTidseewG/XHkGBydiF8epFara6qqpqdnb1x40ZeXp5YLCYL4syBiSAT6O4MAMHi80pHLpez0877hJsknJDzHOGVW5uQlJ7my4TPm5acK0LoBjedkdVqlUgk6DGEnJycxsbG8vJymqbNZnNMTAx6DIGdA1wmkzHrfkajkVF2u92pqaktLS0ymQz9NRc9esDOQM6bQRllLEeV2WnckpOT0WdCJnOcDrdR7loKryHkdHBcuLK8XsQMIC6FO+7v04QxhIkgDCAd+O4MAEHiI8Y4HA6RSOT1OiwC5EzjCCbnOYKbW5tpmpuUnubkpSe3iBPhdoNLZmbmtWvXbDabUql0OBxyudzj8fT396OMdTQrB/j8/DxFUczrj+Lj4+VyOaODroeY1FVms9krAzlTmZuxnJCjgpDJnFeHt1EvfbIhXPx5KRyN9yJ2EnXeFO6EGMNrDkyEsIkAgPAh8udaZ926dX5eFXV3dzc2NvqshnKeU89za4+MjHDTj6Ok9D09PV7lXnnpyS3iRLy6wV1zuH//fkFBgVarnZmZUavVGzZsyMzM1Ol07IUyJgc4Soo8NjYmEv13PCMi/rcIabPZIiIibDYbrpMMRUVF1dXVfX19YrHYYrGoVCqfm4RWB2cI7/hQFIVSNvkJ14vYSdQvXrz4+++/j4+PW63WxsbGd9555/vvv/dfnNx/BEwEwv/dGQBCgM8oJJfLjUajnyGL4ksSjst5Ts6tzU1KT/PlpedtkVeEkHqddwlidHQ0JyensLBweHiYpune3t76+vqEhATe9xdJpVLeJQiHw5GQkHDp0qX4+Hj0Cm6v1RKNRoMus3gzlhNOn3GZzHE6vI1y11J4DQnJEo3/XoRSl9P4Nz7gzMH1n4aJeE5AEwEAweM7xrS1teXk5JhMJovFUldXp9PpCJV5k4Tz5jwn5NamMUnpab689Li05FwRQup1HHK5XC6Xo45ZLJaYmBh2lGLnAK+pqcnNzUWn4R0dHadOnULltbW16OWAra2tu3btop8f2tgZyFtaWpjmvDKWk/O54jKZ8+rwNrqwsCASiSYnJ5n1E5whAcE9tPF6ETOAuNTlNOaND4QxhIkQMBEAED58xxiPx3Ps2DGZTCYWi9H75P3R9doJuTnPCbm1aUxSehqfCZ/bIq8ILvU6jvLy8pKSEuZrdnZ2U1MTu0VmB3a5XA0NDUqlUiKRFBQUoBcHjY2NSaVSdNLqcrm2bdt24cIFtFV7e7tcLo+Nja2srGTe+83NWE4+tFkwmcxxOh0dHdxGjx8/LpFImGDJa0igcA9tvF7EVMOlLqcxb3wgmAMTIWAiACB8BJXbf43jZw7wkGz1SvJihwImAgBWgLDkklk7+JMDHCAAAwgArzZCrmPWYHpqXpgc4AFtBafPDMIGMFTARADACuDXs8te4B6UXFMBhqKoQNN6A17AAALAKw/cjwEAAADCBdyPAQAAAMIFxBgAAAAgXECMAQAAAMIFxBgAAAAgXECMAQAAAMIFxBgAAAAgXECMAQAAAMIFxBgAAAAgXECMAQAAAMIFxBgAAAAgXECMAQAAAMIFxBgAAAAgXECMAQAAAMIFxBgAAAAgXECMAQAAAMLFfwAZciwvfy/dzAAAAABJRU5ErkJggg==)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAFa0lEQVR4nO3cQWiSfxgH8FddvipO23gdWEa6LrFLeRkFMYg6hIfotKw8jBUrRg1PERGbOcJoFLUN6VJYh6iLiIfyUJchHUaESIYw2NSBA2sOxeSdae//8KuXNfV9bfVb8u/7Ofm+Ps/veXTgs/f3uikEQWAAAAAoUP7tBgAA4H8LMwYAAGjBjAEAAFowYwAAgBbMGAAAoAUzBgAAaMGMAQAAWjBjAACAlpZmzMzMzL59+1iWtdvtr169ko1Pp9OKH1Qqlc1mm5ycrNVqEvGdnZ2yyxYKBZ/P10rDEv2IHjx4QKPW9mjz9gAAvhPkTE9PW63W169f53K5Z8+edXd3z83NSaekUim9Xs/zPM/z5XI5Fov19/d7vV6JFJ7nZTshy8qGSfcjqlarNGptjzZvDwCAkL+OuX379uPHj48dO2Yymc6cOTM+Pn7nzp1WphfLsizLarXaAwcO3Lt37/nz59LBrU7FrWJ/plKpaFcEAPjHycyYQqGQzWaPHDkinhkYGPj48SPzY4Pr7t27Nputq6vr3LlzhUKh2ToajaZarZLHX758uXjxoslk2rNnz82bN2u12sa9smbLFgoFq9VaKpUUCsWTJ08YhllfXz9//nxnZ+fevXsnJibIXhxJ9/l8JpPJbDY/evRI4tVRrdUw5fTp07du3RJjDh8+3Gx9ibe3vj0AgPYkM2NKpZJGo9mxY4d4xmAwFItF8dl4PP727dv5+flMJnP9+vWGi3z69OnGjRunTp0ih2NjY9ls9v3795FIJBwO+/3++qL1yxqNxmQySba8XC4XwzBer7dcLsfj8UgkMjc39/DhQzE9mUx++PAhEAhsnI7NXiClWg1TBgcHQ6EQCVhZWYnFYuRtaRjc7O2tbw8AoE1Jb6XV7/svLi7u3LmTPMUwTLFYJOej0Whvb6+YxTAMx3Ecx3V3d2s0mkuXLpE7LtVqVa/XLy4ukshwOHzo0KGNVaSX3dgMx3GlUok8Jrd8xPR8Pr/pVYj9EJcvX6ZUSzqlXC4bDIZMJiMIgt/vP3nyZLNgid4a/lwAANpQh/QE6ujoEPe4iG/fvnV0fM/S6/XiHpfFYsnn82KYTqeLxWIMwyiVyp6eHvHmRy6Xq1QqNpuNHO7fv598mG4ksaxobW3t8+fPVqu1YVddXV2b4sV+xEN6tSRStFqtw+EIhUJXrlwJBoNDQ0MSwa30BgDQzmRmDNmQ+fr1q7hdViwWDQaD7LpKpXL37t1/oMEmeJ5XKpXv3r0TP+6VSql9v9/p51drSacMDg7Ozs66XK75+flgMNgsuFKpbK1bAID2ITNjjEbjrl27otHo0aNHyZloNNrX17flej09PWq1emlpiVzKJJNJ8ff3X2I2m3U6XT6ft9vtW26GXi2JFIfDceHChadPnx4/fpxcpjQMTqfTf6p/AIC/Rf67y9euXRseHn7z5s3q6uqLFy88Hs/Vq1e3XE+lUjmdTrfbvby8nEgkPB7P2bNnW8zlOI7n+YWFBXLocrlGR0cTicTKysrU1NTk5KR0+vrPJP4m9PdrSaSwLHvixInx8XGn0ykb3GJ7AABtqpWbNtPT0729vWq1+uDBgy9fviQnN912TqVS5LsA9U9tUiqVRkZGOI6zWCwej6darW66599sWUEQPB6PTqcLBAKCIPA873a7LRaLTqdzOBzkewQNS9ff8mEY5v79+zRqiRqmEKFQSK/Xl8tliWDp3ja1BwDQnhSCIGz7XAMAgH8C/icmAADQghkDAAC0YMYAAAAtmDEAAEALZgwAANCCGQMAALRgxgAAAC2YMQAAQAtmDAAA0IIZAwAAtGDGAAAALZgxAABAC2YMAADQghkDAAC0/AdZVG9/ve5CUgAAAABJRU5ErkJggg==)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 7 February, 2020 22:31 GMT
Vulnerability Verified: 10 February, 2020 08:02 GMT
Website Operator Notified: 10 February, 2020 08:02 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 10 February, 2020 08:02 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 7 May, 2020 22:31 GMT