Lucene search

K
openbugbountyArwildoOBB:1241929
HistoryJul 29, 2020 - 2:32 p.m.

search.canberra.edu.au Cross Site Scripting vulnerability OBB-1241929

2020-07-2914:32:00
Arwildo
www.openbugbounty.org
4

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: search.canberra.edu.au
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: Arwildo
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAfyElEQVR4nO2df1AT6f34H7mIAcJvCIi5ChyHSBn8ccigRaToKIepk1P8cScqVobjLKcc41HLWY9Six6n1h+UYZhrB63jtY5jKeM4nEM9m0s5BxFjzGGklMMYI8UQASOGENnvH/u9nf3s7rPZBAJI36+/2M3zvJ/3j2f3zT6bPO8ZBEEgAAAAAHADHpOtAAAAADBtgRwDAAAAuAvIMQAAAIC7gBwDAAAAuAvIMQAAAIC7gBwDAAAAuIupm2OioqLu3LmDOwSmGQLjC9MAAF4tpmiOuXv37ujo6IIFCzgPgWmGwPjCNACAVw4HOebBgwe+vr6cHw0MDBw+fBh3OEYaGhrWrVuHO5wAeAx/pcdylgcPHgQGBrp7FIHxnZrTQPg14sKIT58+3blzZ2ho6Jw5c375y1+OjIw4Jc2tuHzJszsODw+/++67DDc+efJk69atwcHBc+bM+eijj4aHh8nz9+/ff/vtt/39/cPCwnbt2jUwMOCyCcAE4PpzTH9/f0VFBe5wjEx6jgEmkimbY8bI2C+K3Nxcm82mVquvXbvW3Nx88ODB8dJt7LhsHaPj8PBwZmam3W5nNNu+fbtYLNZqtUqlUqPRHDhwgDyflZUlk8l0Ol1bW5vVai0oKHDZBGAiIHjp7u6WSCRCPuJp6SxGozEgIMBms3EeTgzjaM6UGstZuru7AwIC3DqEwPhO2Wkg/BpxdsShoSGZTGaxWMjDlpaWmJgYp6S5FZfnLfvWcejQIcZJi8UiFovZtlut1hMnTgwODpLnNRqNTCZz3QbA/Qh6jjl58mRUVFRwcPC2bdvIJ9OBgYHIyEiLxTJjxowzZ87QD48fP+7r6/v555+HhYUFBgbu2LHjxYsXpJybN28uX77c19d3zpw5GzZsuHfvHudwDQ0Nq1evnjlzJvsQJ2F4eHjXrl2+vr5z58799NNPX758STZeunSpl5dXaGjoxo0bHz16hH5Yizh8+HBoaOjs2bP/+Mc/IoRevnz5q1/9KiwszMfHZ+PGjX19fTjD2XD25Rn62LFjUVFRgYGBW7dupcv87LPP2B7jtIttAqdRnDrQ4RSOEHr06NGaNWt8fX3nzZt3/vx58iRjDQe3hsZjOK6vkPgKaYYzh62SU3NA4DRweI3Qo+/j47N58+a+vr6PP/44NDQ0ODh4586dz58/Z8j08vJ6+PChj48PedjZ2RkREUEFyMfH54033vj9739POpPfyWzncDrhD3/4w5o1a6hen3zyyY4dOzjtZVjH43xGpBgdEUJz58795JNPGPJ9fHxevHhB2W6z2Tw9PRFCs2bN2rt3L2npyMjIuXPnMjIyGH2/+uor6m+2Aps3b/7d735HNVi6dCmpxuPHj9euXevr6xsVFXXs2LEJWCL+H8FxjrFYLGq1urm5uaWlxWg07t+/HyHk7++v0+kkEonVas3JyaEfvvPOOxaLpaWlpbW1tbW1ta2trbKykhQll8tzc3P1er1KpUpNTRWLxZwj8iyU4SSUl5cPDQ1pNJrGxkalUllTU4MQamtry8/P7+np0Wq1MpmssLCQskin02m12rq6utTUVIRQZWVlU1NTU1NTR0dHREREe3s7znA2nH15htZoNKRMvV5fWlpKnW/9AbrHOO3iNIF9BqcDBU54YWGhn59fe3v7lStXqBwjEIeDshESXyHNcOZwqiRwDiBh00DINUI1U6lUarXaaDTGxcWZTCaNRnPjxo3u7m5qMnBy//79ffv2HT16FP0QIJ1Od/Xq1bq6OocexjmH7QSFQqFUKp89e0b5fP369aEs2NbhnM+OFNstQjh06ND27dvpZ/72t795e3u3tLTU1tZSJ2/evLly5crc3FzqDFuBTZs21dfXk58+fvxYrVYrFArSq56enp2dnU1NTWfPnhWoGOAY/sec7u5uhBD1ZNrc3BwdHU19xLlWRnbR6/Xk+UuXLiUlJREEYTabRSKR1Wplj6LX6yMjI8m/LRaLRCIxm83sQx4JISEh1GO1Wq1OTk5mNOjs7AwPD6fUo+STSKXStrY2gYYzYPflH5qSqVKpSJk4j+HsYpvAaRSnDnQ4hdvtdrFYTFeGXCtjh9vhGhrdcFxfgfEV0szhHKBUEjgHCGHTQOA1Qjbr7+8nD1UqlYeHx9DQENWLXAviXIAyGAzR0dF/+ctfCFcDxHYObs6kpKRcvHiREmi1Wg0s2NZxOh8XKU4beVbeysrKVq1aZbfb6SeHhoaUSmVCQkJNTQ1BEB0dHZs2bQoKCqqoqKA04VRgaGjIz8+PdGB1dfW6desor3Z1dTG8CowdkcMkJJFIqGfwiIgIs9nssItYLH799dfJv+Pi4vR6PUIoMDAwOzs7JSUlIyMjIiIiKSlpxYoVlNjm5mby76tXryYnJ1MPqvRDnISnT5+aTKbIyEiyy+joqEgkQgjdvn27pKSkvb3dZrONjo6Ojo5SFtEfhAcGBsxmc2JioguG4/ryDE3JlMlklExOj+HsYpvAeQanAwlOeG9vL0KIrgzbah74B2UjJL5CmvH4ilMlgXMACZsGAq8RiUTi7+9P/i2Tyfz8/Ly8vKheJpMJ56Xs7OyioqLNmzcjlwKEcw57ziCEFArF5cuXN2zYcPny5aysrFmzZs2ZM8c1+TwBFc7f//73s2fPtrS0vPbaa/TzXl5ey5cvr6ysPHDgwPvvvx8fHy+Xy7u6uigP4xTw8vLKysqqr6//8MMPL126RD709Pb2jo6ORkVFkR2dnfYAD45zzDjy5Zdf3rp1S6vVGo3G4uLiZcuWnT59GiH02muvzZ49m2zD/40yTglWq9XDw6O1tZW6rXh4eCCEFApFXl5eTU2NWCw2GAyZmZk8ujFmsFOw+zo1NA6cXQLh12GMwl0blI2Q+AppVlpaijNHuEpjmQPu4/HjxxqN5ttvv3VZAmesbTYbZ+P169eT62aXL18m77/k4hidJ0+eOJRP/oELqEC+++67goKCxsbG4OBg8szIyIharV6yZAl5GB0dbTQaEULl5eVHjx7dvXt3eXn5G2+8QUngVGDTpk1VVVU5OTktLS2XLl0Srg/gCvyPOTwP4ALXyurr66mVHzpqtZr9hRC73R4SEkI9sTIOeSRIJBLGQkdvb69IJKI35lxSIJFKpWq1WqDhDvsKHJqSyeMxtl2cJrDP4HSgwymcsRRTX19PdhwcHPTw8KAv9LEF4gbF9RUYX4HNOM3hVEngHCCETQOB1wi/KPpkYOhmt9vptrsWILZzeNamEhISmpqaAgICSGlC1so4nc+AipTAtTKz2RwTE3P+/Hn6SavVKhKJqCW+hoYGalHUZDIVFRVJJJKCggJ+BaxWa1BQ0IkTJ9avX09+RHq1u7ubPIS1snHE9RxjsVhEIlFHRwfjkLxjZmdnGwwGrVa7cOHCsrIygiDa29szMzOvXbtmMpn0en1eXp5cLqckk2um5AIrdZJxyCOhoKAgJSWF/G+lsrKyvLycIAipVFpdXd3f39/R0aFQKHhyTEVFRXJyskajMRgMhYWFSqWS/45AX+Fl9xU4NCPHsD2Gs0tIjsHpQNecUzhBEAqFgq4MZXhycnJeXl5PT09HR0dqaip1ni6Tc1BcX4HxFdgMZw5bJYFzgCdkdKsFXiMCc8zg4KBIJNLpdPTXD4w3Cs4GiNM5PDnm4MGDiYmJ9MuTE7p1nM7HRYpx6+B0o91uX7Vq1Z49e6w0yI/kcvmWLVsMBoNarY6Pj6+urmbIycnJIf/muWO89957fn5+Fy5coDpmZ2crFIru7m6tVpuYmAg5ZrxwPccQBFFWVubt7V1XV0c/PHbsmEQiOXLkiFQqDQgI2L59O/li02azlZWVxcbGenp6SqXSnJycnp4exij79u0rLS2l5DMOeSRYrdaioiKZTObt7Z2VlUX+36dUKpOSksRicXh4eHFxMU+OsdvtJSUlISEhYrFYoVCYTCbhD3DsvgKHZvzrWllZyfAYzi6BOYatA6MZp3CCIAwGw+rVqyUSSWxs7NGjRynDOzs7MzIyJBJJfHz8qVOnOI3iNBzXV2B8BTbDmePQDzxx5A8Zp/Nx14jAHEMQxP79++mXFfvhiQyQt7d3dHS0wwDhYs2TY9RqNUKIUoAHyjpO5/NcsIxbB6cbGSsulDm9vb1btmwJCAiQyWSHDh3iUY9Hgfr6eolEQl1oBEH09PTI5XKJRBIZGXnkyBHIMeOFgxzjAmP5RWFsbOyNGzdwh8A0Q2B8YRrw4I4fyZK/f+T5muK0R6fTSaXSydZimjCh7/wdcv/+fZ5DYJohML4wDSaYq1evpqam/i//CFGtVkdHR0+2FtOEqZVjAACYXAYGBqqqqrZs2TLZikw0v/3tbyMiItatW9fV1VVaWjqltoZ7pZmie/sDADApUC8FJ1uRiSY9Pb26ulomk+Xk5OzZswe3iQ7gLDMIgphsHQAAAIDpCTzHAAAAAO4CcgwAAADgLhznGPbm2M5ujc7g+++/9/HxuX37NkKor68vMDDw66+/HkeTAAAAgCmC4xzDuY+6wK3ROXcFj4qKKi0tLSoqQggdPHgwKyvrpz/9qXutBAAAACYDB+/8nz59KpVKLRbLrFmzqJMPHjyIjIw0m830b9CHhYU1NjYuWrSI3p1dF4vcw3VkZCQxMXHLli1VVVVarTYsLGwcTAEAAACmGA5+H4PbnVvg1ui4XcFnzpxZVVW1atWqU6dOQYIBAACYrjj+DSZ7c+x9+/ZxtmRvjc6zK3hPT4+Hh0dPT4/zOgMAAACvBs79PubOnTtyuVylUiUkJFAFWUnCwsKuXr26YMEC+kncWtnAwEBcXNyJEyd2796tUqnmz5/vqv4AAADA1MXBO/979+69/fbbX3/9dV9f38OHD6uqqhYuXMjZsqioKD8//+7du48ePfrwww+/+eYbhNAcFmTj0tLStLS0zZs3FxcX7969e3xNAgAAAKYIDnJMTExMSkpKQUEB+TLGarV+8cUXnC1LSkrS09MzMjJiYmIMBkN8fDxO5q1bt86ePXv06FGE0L59+7q7u//85z+PxQYAAABgagJ7yQAAAADuAn7nDwAAALgLyDGCuHPnzgcffDDZWkx/RkZG3n333f/+97+TrQgAAOMD5BhB5ObmRkZGTrYW05+ZM2d6enrivhwPAMArxzTPMeTWai50HBgYOHz4MPl3X1+fRqMhN79hy39VygXSLcLhbnOEhKOoqKipqcmhqH/+85+LFi3y8fFZunTp3bt3x0Ull2cLCeXhMcrhhC2TEawzZ87Mnz/fy8tr/vz5p0+fpjebMWMG20V//etf+WMtxIpt27bt3buXOvzmm29mzpw5MDBAnVmxYsXJkyddkO8wvh999JGXl9eZM2f4NZw2uGNSTRCTW+rZ3XR3d0skkjF25BHijmrqbkKIKybAHKvV6lAHISELDw+vr683m81lZWVJSUku6yMw0M6KcmjmWIRTZ6hg1dbWymSyy5cvm0ym69evx8TElJeXU80QQrm5uQyBKSkpDmPt0Ira2trFixdTh2TtyEuXLpGHNptNLBar1WqBFtHhj6/JZPLw8FCr1Xa7nV/D6cS4T6qJYZo/xwBTDfrGd2PBbrcnJSUFBgYmJSXZbLZxkTmOjJeZAikvL//Tn/60du3a4ODgFStWXLhw4ciRI8+fPyc/FYlEFy5cePz4MdX+22+/VavVDsU6tCI9PV2j0VA/x25qakpMTLx27Rp52NLSIhaLGb/LFgh/fC0Wi7e394IFC9h7i0xjJnhSjReOc8zz58/ff//90NDQ119//Te/+c3Lly/Jp7Zjx45FRUUFBgZu3bqV/nQ8PDy8a9cuX1/fuXPnfvrpp1R7ei0AzuoA7IHQD0+IjJac3Lx5c+nSpV5eXqGhoRs3bmRvMcCpG+cQAwMDkZGRFotlxowZ7IfxR48erVmzxtfXd968eefPn+dxFHmeXfWA8dhLLXrQHevj47N58+a+vr6PP/44NDQ0ODh4586d1F2Dx8+cceGxyClzhGvIGQ7KcP4pROerr77iPL979+6srKxf/OIXpaWldLVxPuePEQ7OCcMpnO7h48eP0+Pr0JP8HnDIwMCAwWBIT0+nzixatOj69evUoVgslsvlVVVV1JkTJ0689957dCHseLFXEdnavvnmm1KptLm5GSH07Nmztra2Q4cOUUudKpUqLS2Nx5MIoc8++ywsLCwwMHDHjh0vXryg9OGJb19fH2My4+5R7HuOwIuLDe6aRYLLmkz8tTNFcJxj9uzZYzQa29raGhsbGxoaqqurEUIWi0Wj0TQ3N7e0tOj1+tLSUqp9eXn50NCQRqNpbGxUKpU1NTWIqxYA+wznQJwtOUsGtLW15efn9/T0aLVamUxWWFjItoVTN/YQ/v7+Op1OIpFYrdacnByGkMLCQj8/v/b29itXrtBnP05/zqoHOCwWi1qtVqlUarXaaDTGxcWZTCaNRnPjxo3u7m4hfuaMC49FzpojUEOH4eCZQnRyc3NXrlx569YtxnmJRNLV1VVXV9fY2PjjH/+Y8SnO5zijcHA6mVM43cPvvPMOXQiPJzk9wDm9ebBYLGKxeObMmfSTS5Ys8fHxoQ737dtXU1ND3sQfPnzY2NjI2F/D5Xilp6erVCqE0PXr1xcuXJiZmWkwGMjbokqlojIfbrq2/kBbW1tlZSU1HE98g4ODGZMZd49i33MEXlxOhUD4BT7B185UgX8pzW63k8EmDxsaGlJSUsgV3sHBQfKkSqWKjo6muoSEhFgsFvJvtVqdnJxMtjebzVQb9hnOgThbEgRhYMFQu7OzMzw8nGCt+bJ1ww2BW6a32+1isViv15OHly5dIhe1cfoTBCGVStva2nDCCdrCOqlJf38/5VgPD4+hoSHysLm5OSYmxqGfcXHhXP521hynNKRgh4NHVYaeFouloqIiKCho06ZNHR0d5MkvvvgiMTGxp6cnPT09MzOTHEIqlVK92D7HGcX/PoZzwnAKZ1hHnzA8nuT0AOf05nkfw/9ig/o0LS2tqqqKIIiSkpL8/Hyed29kvBiewWlbW1ubnp5OEERRUdHBgwcJgpDL5XV1dQRBBAUFtba24jxJyqTPPeq9i8P4OvQw7p4jcOqyQ4C7Zgn8fGAwAdfO1MRBjjEajZ6entRhR0cHY/IR/9fdZrMZIRTyA0FBQVKplPPyYJzhHIizJY62trZVq1ZFRESQ47IvP07dcEPgbj1Go1EsFlPN2tvbyYFw+vf394tEIsabSZ4cg3Ms4byf2d3ZZjprjnAN+cPBI4dTT7PZrFAoRCIReUhd1UajMSQkpKKi4saNGwsXLiQ/5fQ5ziieHMPpZJxwnHWueZJHOLuLwWCgBxHXsaGhISYmZnBwMCgoSKfTMUZkx4vHM/S+Op3O29vbZrMlJCQolUqCIE6dOpWTk6PRaPz8/EhH4aYrY+5RWYQ/vkI87PCewzN1+d3IaM8zH0JoOKWAy9fO1MTx3v5OYbVaPTw8WltbRaL/L9nDw2PcX8lylgxQKBR5eXk1NTVisdhgMGRmZgrRbXwVwzHubyYnxs9jwWE4hPOf//zn4MGDSqWyvLwcIfTkyROz2UxWw5s9e3ZdXZ1CoWhtbSXXQyjG7nOeCePWV82c09vb29tqtb58+ZIamnzvjRAiV41GRkboy2W3bt2Ki4ujL5f97Gc/Kykp2bRpU0pKyrx58x48eEAfwuV4zZs3LyAg4MqVK3q9PiUlBSG0atWqI0eOLFu2LDU1ldTWqekqML5uhR2C1tZWnvac80HItyo4GcdrZyrgIMdIpVJPT8/vv/8+KioKIaTT6fh/ijh79mxvb29qipAwZvPYB2IH78mTJ0aj8de//jV5aDKZBOrmLFKpFCH08OHD119/HSHU0dHBr7+/v39QUNCdO3fo364JCgoaGhp69uwZ+RLPYDA4q4bLfh6jOQIREg6BfPDBB+fOncvPz+/o6AgODkYIBQUFiUSif//732+++SZCaO3atT//+c9ra2u1Wi3ZhdPnLhiFmzCcwnG44EnOe1NoaGhQUNCNGzd+8pOfkGeUSiVZFdDf318mkymVypUrV5Iffffdd2lpab29vQwhxcXF+fn57J8fjTFeaWlpZWVlaWlpZJKbP3++h4dHbW0t9bUC3HS1Wq30ufejH/0ICYgvgzHOVU7YIfDz8+O8ZnGTDeErNPIzjtfOVMHhk05eXt66dev0er1Wq128ePGpU6f4H9YKCgpSUlLImmaVlZXl5eVC1so4B8K15EQqlVZXV/f393d0dCgUClKlwcFBkUik0+nIh1m2brghLBaLSCQiXwDo9Xr6Q71CocjOzjYYDFqtduHChZTtnPoTBFFRUZGcnKzRaAwGQ2FhIbmekJycnJeX19PT09HRkZqa6uxamRA/M9rTLaJ/0d4pc4RryBkOIc/7nZ2ddJk5OTnd3d2M6OzevXvZsmVardZkMtXV1YWEhISHhx84cIBqwOlzTqPoM4QxWzidzCOc8jDDOhc8yUlVVVVsbKxSqTSZTBcvXgwKClKpVORH9N/HKJXK+Pj4Q4cOUZLpv9q5du0a54jseAlcKyMIgnyBT014giByc3MRQi0tLdQZzumKEKLPvbKyMoHxdejhcV8rIzDXLIGfDwwm4NqZmjjOMRaLJT8/PyQkRCaTlZWV2e12fiOtVmtRUZFMJvP29s7Kyurq6hKYY9gD4VpyolQqk5KSxGJxeHh4cXExpdL+/fu9vb3Jl5Bs3XiGKCsrIztarVaxWEy9cDYYDKtXr5ZIJLGxsUePHqUG4tSfIAi73V5SUhISEiIWixUKhclkIgiis7MzIyNDIpHEx8efOnXKhRzj0M/syUdadOzYMXozp8wRriFnOIRcJxcvXkxMTGSHg47Vat2/f39kZKRYLF68ePG5c+e6urq8vb2py5vT5zij6DOE/jenk3mE4zzsgidxHD9+PDIy0tPTMyEhgfqpI0ldXV1cXJxYLI6NjaXf7nHTmzEiO17Cc4xOp0MItbe3U2fOnz8vkUjobylw07WyslIqlQYEBGzfvp16Ae4wvgx9HN6jHJogxP+c1yzBOx9cU8Dla2dqAnv7C2Lv3r1arfYf//jHZCsyzRkeHo6Liztw4MCuXbsmWxcAAMYByDGCGBkZUavVS5YsmWxFpj//+te/qFcOAAC86kCOAQAAANwF7FcGAAAAuAvIMQAAAIC7mNI5ZowVJsYOVaOCsSGdO8YiEVjBxbXiGWzlGUVlxtGlY3QUo7uQ4jcAAExFJvl7bbzwf3F5vCqI4GDUqCB/UyL8u9SuIeSbiC4Xz3D4hc5xdOnYHUX/EY+73Q4AgJuY0s8x/Li7ggijRsXUKd7gvuIZU6ooy9RxOAAALuNKjrl58+by5ct9fX3nzJmzYcOGe/fuIXx9CJ5aCIyqMLgyDCdPnoyKigoODt62bRu9UgJPhQlS/ueff84oTSG8bg2jRgVu5QdntVPgKrhwCmcoxl9qgvIG5/obu6gMf1EWzrjzj8WuDiKwigZdLH85HwAApjKu5Bi5XJ6bm6vX61UqVWpqqlgsRvjSLLhaCOzqDpxlGMiKC2SlBKPRuH//fkoN/goiFoulpaWFXZpCYN0ado0KTnBWO1V/AlfBhVM4QzEhVXNwsIvK8LuUM+484KqDCC/jwamns+VVAACYTJxdXDObzSKRiF1ZmrPSBgN6LQTEKtnCWWcF0SolNDc3U5US+CtMdGNKU7DH5an7wrmXBuPFAM5qhxVu6ApwVnDhEY57OYGrmkO94+F/H8PvUlzcecbiCYHDKhpssdShcN8CADDpON7bn/5/4pMnTwIDA7Ozs1NSUjIyMiIiIpKSklasWPH06VOTyURtdzo6Okpt4n379u2SkpL29nabzTY6Ojo6Okqel0gk9EWVgYEBs9lM7iNLRyKRUGsmERERZCEKhFBpaWljY2NYWNj58+cTExMPHz5M6kN1FIvF5H6uCKG4uDi9Xs85bm9vr81mI3dsJVuSN0Eh8FgtfMtVcnNcuqoOhdPBudcF+F3KGXd+gTwh8Pf3J/+WyWR+fn5eXl7kYUREhMONZl3bzhYAgEnBcY5hb3P95Zdf3rp1i9xCtbi4eNmyZaWlpbhKG07VQhD4EnsqVJhAvPVFOEuAjJdwOuNVakKIS9lxP336tGvDjYWx+xYAgAnDcY7h/LfxrbfeeuuttxBCWVlZcrn89OnTnJU2hNdC4CnDwEZIhQnO0hRsxlJ8gqcgjfDyRLgKLkKq3eDc60J9GoFFO9hx5xlLYAicxeXSTwAATALOLq61t7dnZmZeu3bNZDLp9fq8vDy5XE5gKm0Qjmoh0GGXYeDZxZq/wgSuNIXwujUE5n2MkII0zoKr4IITTleM070EptYFuz4KvagMv0txcceNJTAEuB3O2Zu3U3oCAPAK4XSOsdlsZWVlsbGxnp6eUqk0Jyenp6eHwFTaIBzVQqDDLsPAcz/irzBBdjxy5AijNIXwujUEJscQAgrSOAuuggtOOF0ZXNUcXK0LRn0U4v+WyeFxKS7uuLFw1UFcyzF0PV3wMAAAk8X03Hf5wYMHCQkJz549m2xFAAAA/qd5hX/nDwAAAExxHL/zB8YF3E8Fu7q63LrJJgAAwCQCOWaCwH0bChIMAADTmOn5PgYAAACYCsD7GAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3AXkGAAAAMBdQI4BAAAA3MX/A6dKwDMrycLoAAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQjUlEQVR4nO2db0xb1RvH76CB0pXyZ9Bh7TZYDBhDCDGEgCLiYhzWhnQdQ4LoSCRgDCD2xYLMYGVxY7AZRURCZjKNcW8WQgghaBo0dfKCKV5rx7qOEOigIAIrDLAjhft7ceL93dz//XP5l+fz6vbcc5/znOecex/OKf3eAwRBYAAAAAAgAWE77QAAAACwb4EcAwAAAEgF5BgAAABAKiDHAAAAAFIBOQYAAACQCsgxAAAAgFRAjgEAAACkAnIMAAAAIBXCOeYAG9HR0ayVp6amuE7R+OGHH2JiYhYXF8mS559//vz58xiGPXr06L333jt27FhUVFRaWtrly5c3NzdRHZ5TYqC6x3UcWHdYef/996Oioj799NNgjATpw3ban5qaiouLC6HN5eXlS5cukcYljUPIYb1xgp9pey4OIRnEHXlcAKGBEMLr9Xq9XofDERsbi46dTqdSqeSpL2gTodPp6urq0HFPT49Go1ldXSUIori42GAwOByO+fl5i8VSUFAwMjKCqvGcEgnp3uTkJNkL6jEVrnIxLCwshIWF4Tju8/nExyS0Pmyz/cnJydjYWHQcTJepBgXHaNfCvHG8Xi9PL0RGbM/FIVSDuCOPCyB4hHMMgvr4CNUsdzgcCoViYmLC5/OlpqZev36dIIj19XWZTObxeJj1eU4FgNQ5JlRR2qM5JlQG926OQdBiEnwv9lwcQjWIO/u4AAIm8O9jPv/885SUlEOHDr355pvLy8uokLoWvn379gsvvBAdHf3kk0+ePn367t27NAtpaWlVVVUNDQ3d3d0qlers2bMYhm1tbWEYJpPJmC3ynCI5depUW1sbOv7zzz8jIyNJ36qrq6urqwNYql++fPnw4cNxcXFnz579999/UeHjx4/ffvvt6OjoY8eOffTRR7Q1+OLiYnJy8urq6oEDB6h7ZSg+ly5dSkxMfOKJJ77++mtBU1w+fPnllydPniQrnD9/HgUwyIbW1taqq6sTExOPHDny8ccfk3Vu376dm5sbFRWVmJh45syZmZkZVD4zM3Py5Mno6Oi0tLTvv/+e2jp5cPXq1ZSUlLi4uDfeeIMcjtnZ2ddeey06OjolJeXq1atok43K8vIyGcNvvvkGFbLOOv5+IR/a2tqYg8jVKS7fxARQDMxe0DaRBO8dv+bk5ubmBx98cPjw4YMHD545cwbtOLH2neYGufnJ4xJ/TEI1iJg0jwtgGwgwx6yuruI4Pjw8PDIy4na7GxoamHX0en1FRYXL5bp161ZeXp5cLmfWaWpqGhoaamxsbG9vRyUHDx7U6XSlpaW//vrr2toatTLPKWqjFosFHff3929tbQ0ODqKPFovlpZdeCqCnv/3H6Ohoa2srKm9ubl5fX7fZbIODg1artauri3rVoUOHHA6HUqn0er2nTp2iGXQ4HHa7/fr163l5eYKmuHwwGAxWq/XRo0eoTl9fn9FoDLIhDMPq6urcbvfo6Ojg4GBfX19nZycqHx0draqqmpubs9vtWq22pqYGldfU1KhUqrGxsYGBATLH0Nyw2WxoqrhcrsbGRvLCiIiI8fFxi8Xy7bffMi+MiYkhY1heXo5xzzoxARwZGWEOIk+nWH0TE0BBgr93/J2Tra2tFovFYrE4nU6NRjM2NsbTdy64XOKPSQgHEZPgcQFsByLXO7S9MgzDVlZW0Mfh4eHjx4+Tp9BaeGlpSSaTidliLi0tPXr0KLVkZWWloaEhNTVVJpM99dRTZrPZ5/MJnkK43W6FQoHazc7ONplMZWVlyDGVSjU+Ps66bOfZK8MwzOVyoY89PT1ZWVnoOCEhAW0HEwSB43h2djbzWmST1hCGYUtLS9Sa/KZ4fMjJybl58ybZBDXa4huiuufz+ZRK5cTEBPrY19eXk5PDDMv4+HhSUhKqL5fLqb6hSULtO3Wq3Lp1C00VdCHZEHkhVwyZpqizLuAA8nSK1TfBQWftAm2vjLUX1J7y3zsBzEm1Wj06OsrjJNl32o1AOs/jkvgbgaf7YuwgQvu4ALaBEHwfw3WqtLQ0MzPTZDJduXLl559/ZjVrs9liY2PT09O7urqYZ71e7/DwcE5Ozocffij+VGZm5tDQ0NzcnFar9Xg8arXa5/Ndu3bNaDRy5RWeHCOXy8mPY2NjarWaIIilpSUMwxL+Iz4+HpXTrmXNMbSGBE1x+UAQREtLS0VFBUEQHR0dJSUlrK0LNkSt6Xa7IyIiyEucTid69BAEMTo6+vLLL2s0GnQtGnG3203zjZljWKcKrSHyQq4Y8pgKJoBcnWL1Tcygs3aB5/sY8iytnOfe8XdOejwemUzGfLay9p3n1mZ1ya8bgce+yNhK8bgApEbCzcobN278/vvvdrvd7XabTKbnnnvuiy++oNWpq6szmUz5+fnFxcUlJSW0TfnIyMjc3Nz29vby8vILFy6IPKXT6SwWy8TEhF6vj4mJyczMtFqtFotFp9OFqmterzcsLOy3334jd3vDwgLcdQzGlNFoRJtg/f39FRUVkvpsMBgqKyu7urrkcvn09HRhYaH4ayUlmH751akQDrogYu4dv9wLDw+n1fd3QFldClVMRNqR4nEBSI7IXBTAOoYKjuNarZZWePPmzaNHj66vrxMEYTAYampqUDm5ZEZYrVZyQc1zimR4eDg7O7uoqGhgYIAgiM7Ozrq6uqSkJLfbHcA6BqPsS/T29pL7Ekqlkn//QeQ6RtAUjw8EQaSnp1ssltjYWHL/wd+GxOyVzc/Py2Qy8hIcx9GI0/bKent7Ra5j0IWTk5OoXOReGdesCyyA/J1i9U1w0FlbD2AdQ4V27wQwJ9VqNY7j1BKuvq+srISFhVH3NlnHheqS+BuB2U3xg0hI9rgApEaqHDM2NlZYWDg0NLSwsOByuSorK/V6PdXg+vp6cnLyd999hz46nU6FQmGz2RwOh1qt7u7udrvdHo/HarWmp6dfvHiRIAieUzTUarVarUbbx9PT0yqVKjMzk+b5ysqKTCZzOBw+n496TOs1hmHFxcXT09N2uz0zM9NsNqNT77zzTk5ODvqzrrW1tbm5mRkxkTmG3xSPDwRBNDU1ZWRk0GLrV0O0vldWVhYVFblcLrvd/uyzz7a3t5Mh7ezs9Hg8TqfTYDCQI24wGKi+icwxxH+/XZicnLTb7RkZGazPstXVVZlM5nQ6+U0FHECuTnH5xtUQz/eOAeQY/nsngDl58eLF7Oxsm802PT1dU1NjtVp5+p6dnV1ZWTk3N+d0OvPy8lA5j0uCN0JIBlHSxwUgKVLlmI2NDbPZnJqaGhERoVary8vL5+bmqAabm5tpX+vV19cXFBQQBDEwMFBQUKBSqRQKRUZGRnd3N1mH5xSVsrKy4uJi8mNWVlZjYyPT84aGBoVCgf7RnnpM7ZpSqWxtbVWr1bGxsW+99Rb6M4ogCK/XW19fr9VqFQqFTqcj//anXUuIyDH8pnh8IAgCx3EMw2hu+9sQte+rq6tVVVUJCQlarZb6HanVas3KypLL5UlJSSaTiRzx6enpV155RalUpqamXrlyRXyOmZub0+v1SqUyOTm5paWF64c1ZrMZ+cZjSkwAW1pamAHk6hSXb6wN8SxBiIByDP+9E8Cc9Pl8586dS0hIkMvlBoNhYWGBp+/j4+MnTpxQKpXPPPNMe3s7KudxSfBGCMkgSvq4ACTlAEEQ274/B4SMtbW1hIQEt9vN/H3JHuLevXv5+fl///23FManpqbS09PJf/L2F0l9A4B9D2hi7m1+/PHHvLy8PZ1gMAzDcfz48eM77QU7u9k3ANj9wI9g9zDLy8sdHR2lpaU77UggXLhwQaPRFBUVTUxMNDY2NjU17bRH/2c3+wYAewtYx+xhyB35nXYkEAoKCjo7O7VabXl5eV1dHVUIZ8fZzb4BwB5D6i98+L8R9cuOSL1FWosej2ef/TOJXyHl+bdsQSPbEDox/7zLZP+NKQDsV/bhOubYsWMLCwvkR/Q82kF/die0KLGynaET4w8JjCkA7BX2YY7BMCwyMnKnXdgD7LYo7TZ/AAAIHoEc45cuOr/aPMIv6XhW3XgaTMlxqj45U1pcUDWd6SGPQD2/Jxi3YjmPsjpNkJ9VmB3jEEjnIgAxeWboWMeO6bPgNOB/HcDrr7/+ySefkJVzc3NJTXjWMfVXnx8AgO1EeB0jXhddUG0e81M6XlA3HhNSQWdKiwu+cYDVQy6BekFPuBTLuZTVmYL8rMLsYvThqSMYgJg8M3RcY0fzWXAa8A9rSUlJb28vOp6dncVx3GAwUCvQHPNXnx8AgG2F/+uaST910Zlq82LksFitcenGU2GVHGf+llikajqXh5McAvWCnhDiFMupyuoYQ5CfKcw+yS2QzoSrspiwiBk7Vp95Xjog+DqA9fV1lUqFKnR2dhYVFbF2ivUfBMTo8wMAsJ0I/z5GLpcfOXIEHT/99NMulwsd//HHH+fOnRsbG9vY2Nja2kJvnTMYDP39/adPn+7v79fpdLQd9vn5+Y2NjZSUFNIaekKxWpufn8cwjNo007e4uLji4uKcnJwTJ05oNJqsrKwXX3yRpy+C9bk8VCqV5M6SVqtFUuSClh8+fLiwsJCcnIzqbG1tkbKyrNFDDVF3dZaXl5eWljIyMmjNUf3RaDRUfxITE8njf/75h7+y+DDyjB3NZ4x3GggOa1RUlE6n6+3tra2t7enpEdSTZo3k/Pz81tYW1Vt+IwAASETg3/kbDIb8/Hyr1Yrj+MDAACo0Go3ouL+/n7lR5q81Mdy4cePatWsZGRkbGxsmk6m2tja09YPxhFQsx3Ecx3GbzYbkxTA/+8sUZucBpxCM8+KvZRLwNECg7bKHDx+OjIwUFRXxVw545gAAsB3wL3P81UUnGGrzAUvHc+nG84Akx3n2yljrU0u49sq4hPz4PSE4FMu5osfqKlOY3S9/ghGTF7lXxmqH66UDgq8DIAjC6/XGx8d/9tlnRqORv1MB6PMDALCdiFrHmEymmZmZO3fumM1mvV6PYVhiYmJ8fPxXX321vLx8//59s9lMVjYajSaTKS8vD+3PxMfHe73ee/fubW5uhoeHl5aW1tfXP3jwAFkrKyvjshYeHl5YWEhtmunY3bt3X3311Z9++mlxcfHBgwcdHR2ZmZm0OgkJCV6v9/79+2Lqc3koCJfl8vLyd999986dO7Ozs21tbej9SDzRY1JfX19VVfXXX3/NzMzU1tb+8ssvYvzxCy7nqaHzNzK0aUAiZlgjIyMLCwubmpq4ZHJIx7giGR4ertfr6+vrp6amaK08fvzYn9gAABAc/CkoAF10ptp8wNLxrLrxVFglx5l/WZPS4oJvHGD1UMy6gcsyl2I5a39Z1wRMYfaQr2N4wkKGjmvsuNYxXC8dIIReB4Do7e1VKpXUtxjQIB3zS58/VKoTAACIREDbPwBd9P2hNg8Eya6aBqDPDwA7Reh/578/1OaBINlV0wD0+QFgpwixtv+eVpsHQsVumAagzw8Au4EQr2P2tNo8ECp2wzQAfX4A2A3Au5YBAAAAqdifussAAADAbgByDAAAACAVkGMAAAAAqYAcAwAAAEgF5BgAAABAKiDHAAAAAFIBOQYAAACQCsgxAAAAgFRAjgEAAACkAnIMAAAAIBWQYwAAAACpgBwDAAAASAXkGAAAAEAqIMcAAAAAUgE5BgAAAJCK/wEla56GprR/JwAAAABJRU5ErkJggg==)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 29 July, 2020 14:32 GMT
Vulnerability Verified: 30 July, 2020 08:43 GMT
Website Operator Notified: 30 July, 2020 08:43 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 30 July, 2020 08:43 GMT
Vulnerability Fixed: 30 July, 2020 14:16 GMT