HEX

File: D:/hMailServer/Data/itpartnership.com/surinder/32/{32A28978-8AD1-4F3B-A49C-497D09D26671}.eml
Received-SPF: Pass (protection.outlook.com: domain of
 castironradiatorcentre.co.uk designates 52.17.62.50 as permitted sender)
 receiver=protection.outlook.com; client-ip=52.17.62.50;
 helo=eu-dlp.cloud-sec-av.com; pr=C
From: "Paul Brown (CIRC)" <paul@castironradiatorcentre.co.uk>
To: "support@securitymetrics.com" <support@securitymetrics.com>
CC: Surinder Singh <surinder@itpartnership.com>
Subject: FW: PCI Scan Failed [www.vintagedoorknobs.co.uk]
Thread-Topic: PCI Scan Failed [www.vintagedoorknobs.co.uk]
Thread-Index: AQHdG7u8TXFCNWrdM0+23RT/k5Xa5raBZYNA
Date: Mon, 27 Jul 2026 13:52:15 +0000
Message-ID:
 <CWLP123MB5865729D0216B864AE957F20E2CC2@CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM>
References: <4916d619d26c4b66822d2405bc5c9cdb@securitymetrics.com>
In-Reply-To: <4916d619d26c4b66822d2405bc5c9cdb@securitymetrics.com>
Accept-Language: en-US
Content-Language: en-US
Authentication-Results-Original: dkim=none (message not signed)
 header.d=none;dmarc=none action=none
 header.from=castironradiatorcentre.co.uk;
X-Microsoft-Antispam-Message-Info-Original:
 N17TmoogZiqixSSsm/B+wzmQAItpDrzUmFSvhX4j7HMv6UkruNh+VhgAe4VJk7XulJUGKll616/yWv4T8AitLF9MeGmUyl/eKoDJPPdRCQK7YDpPTiglYw89wh3+lWRNbdB/ugtf3FGVPNJk7qlgF2AByw+Cmn2Dc0y6S/2Z3abk1Dxsx95f/t81lHUVIdRZphm55XQfzg2Ddv60pS11A6Fw1cCao9RHMNMxfYsX3CuyhdHSG2at38Gxe/POIMGi34OWH+E82UGX4cL+QelQ9w75cVzkxIfi7hFUySW9PPjr7n3KfL2GAwYBevAgCcyeXLudIb/VJMWXLJaLwsnZ7RljqWEZhfDwBeiJyHrpC029s27mmF5KyPwwyVijFHqx1taX9BOkxP9hkzCCR2O25JAW5tgWG0W+4goAvj2WhXjId7cXPqN90nQKwaFAvCA7yFLU7NCDs5G2f9JzCYMmv/YSQpMQSinfmHXJYL45bWJgrFR1/PJ0xjWJZpe6S4wcpCrtgjJwYo/brA7O76UisCmedRo1cxsGl8J4KUDCbKeTjMoH742G4WcgrMbp7H8NGsjtyupMTzhrC9RKKowDPOoKhRzOwj2zL+rk6oIXwzFP3Jg18VvUY8uh7Effhb1ndFKFcnboBNhGUn9J8zZuWnOl66mbmfYBCwIwknTxznU=
X-Forefront-Antispam-Report-Untrusted:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB5865.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(7049299003)(6049299003)(3109299003)(1800799024)(69100299015)(23010399003)(376014)(366016)(18002099003)(56012099006)(10067099003)(22082099003)(5023799004)(3023799007)(38070700021)(8096899003)(13003099007)(4053099003)(6133799003);DIR:OUT;SFP:1102;
Content-Type: multipart/related;
	boundary="_004_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_";
	type="multipart/alternative"
MIME-Version: 1.0
X-Exchange-RoutingPolicyChecked:
 lDrqTGhjQ6zsZ+lsYRIAfvXRg/SAO2bWdcr/ZcU+YYHOGFxJeiAoq4651Y4FeVMVLAlTYOLU7YnWWuUqNMex3nd3C2OpLhBjToNL6LsHI00EVDladMUtNHAtcRMeo/e2z5bivudy+1RP2mz6vT2mdWr9uL9zUHQ1dYUN7SwFbvkmVztOe8klgZSZ+6mWukUxPWwJJfDkX0hgkArW+P57+OFARWopzSK9M3GiRrMwzhpLUi0MvhWFOVk+N7f+q4yYjpykJSoAGmk0gnuHSxzYg481D+GSEVaKQIlyN1NA9uQGaqbzMDOTDAHgJmyT8cG5j3iU4y6r/BmvXi1q4dcs3A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO4P123MB6484
X-CLOUD-SEC-AV-INT-Relay: sent<mta-outgoing-dlp-mt-prod-cp-eu-2.checkpointcloudsec.com>
X-CLOUD-SEC-AV-UUID: 2833f8e7641f442095e25f4edeebf0ca:mossmeadltd1,office365_emails,sent,inline:f990616aa800ee200b11747f20b4788f
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
 b=d4kyuFz7ki5yLrNkIhLiui842/+8yw3mEVKw9sg/Wyb9KY8cbsQxG35N4RTY5AZBauLYzXHUchM0p60lEWMwV4mlUxiNu9Skrw6FBmBiQmsxtnyAePql2/F3XcNeuZhvm9bQ7yE6LAaDBD+yi5yLqKpmm/eCwoq6haVVKnfsiyWda+n3r2rDyp8dRvMpZJhVZ5XDMedGmUEXNfg2NHz+mmXDJlTRkaGh+hly1VU6WpaRys+mg2/WmqqfjUTVTUI6bBcyn/9mAHi4M0j1lJMLsC1hTRLmp4BeXKM68bIWG0rbnOpXxwBGo2aI7SgWimLqMMxwS2mWI9rhAAzcnq7ctg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version;
 bh=bIMAfjDk5dApZsPxqwSfz/CwN/+PBvEullQ3n9gD13I=;
 b=yq0ANFYqJZK0puFxzC+kgM5n/zfNrq3idLqzONhdxTQBvxUrbv6uwpBVpPqaun1+xeCw/D1dwJkvbhXAh+9fNAulsASlvv52uMttKdhNcZf+5PY1J5zCBaXAzWrrZtmvS2NZcghsvxgxSaAYI1WzOMIZVaNTZMJCZ+Xp+hINK3zrBGfmf5jj5CpnN4PvjDv2QCjn5FkdbAlyQKlhsUZ3axB4fzjAH+eeVML2TtrKVPOd7eYSIZY9dYFXZvGTErnYSrOAm4js5zolz8rWsfJCdP06oOICEfOrCQlW8HP88mtvVEBaP6JtpDTrj014tGtPL+ko2sJ1GxlgHYr682dlKw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=castironradiatorcentre.co.uk; dmarc=pass action=none
 header.from=castironradiatorcentre.co.uk; dkim=pass
 header.d=castironradiatorcentre.co.uk; arc=none
Authentication-Results-Original: mx.checkpointcloudsec.com; arc=pass;
 dkim=none header.d=none
Return-Path: paul@castironradiatorcentre.co.uk
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 LO1PEPF000022FF.GBRP265.PROD.OUTLOOK.COM
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs:
	cf584b8e-5e8e-42d9-d9ef-08deebe64474
X-Microsoft-Antispam:
	BCL:0;ARA:13230040|69100299015|23010399003|1800799024|82310400026|376014|36860700016|7149299003|35042699022|14060799003|3109299003|7049299003|6049299003|13003099007|4053099003|6133799003|56012099006|10067099003|5023799004|4076899003|8096899003|22082099003|18002099003|3023799007;
X-Microsoft-Antispam-Message-Info:
	Oca0N5QHCOOSs78qnL5KbNFBItXwN3aWbNP0BPHPhh+TjsssuwXDsODsvI7sfOzBPT+g03oy4Uf+9I4djcyTqk0F1JL3VSSl8CIJmpAqSBFPJSNjeTjqe865qJNP5hAfo+UBTek6CU3SRXSWXs4rId0lly1wy6pfjyzLswiwz4FtBkC1KhlsUQ5ySyRcPw0BMeHd8tNzUJIhFF6cSZ+sm0Fic5ZGoOM8UFTVP4oYj0Ux3yMjw7wqFb8vkQrCKjh9Z4lfo9hClV1LdAydewYXQVainZ2ola/939x9Ke9BmNqQZfwCebcVGeoRyLgQT+90M3uy9sxovT+A5j4K+psp/kcq08htfy+BVC/J44lV4IDrfDPhgk18f+cWiYOdBUozlDT/JLAAwGUVs/5jLEHtZD7YQPknJiN3n9q19aZQjsMYgoe9j2u/etHnVHL8j35nS0EWg1hn7zbV6Getc+Ye9fq0jn/Bad3VIVYMh5vf/0r8FaJaq7UoXs9rbyV/5FkyP+LB8LhCxuQbCyLTBIClxkuqXcY9IIMtCkDsEY2yiJ1Q7NAVU6UCA4/U/iJTsnaEtYpjzSNzxzhWDJsIi5ud6KwFgM6ifWf5kyMvSP8ZGYOHNViEyLNum9mXh0kHVQ8DrRi+vZYsX8K90dcdRYhJ5w==
X-Forefront-Antispam-Report:
	CIP:52.17.62.50;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:eu-dlp.cloud-sec-av.com;PTR:eu-dlp.cloud-sec-av.com;CAT:NONE;SFS:(13230040)(69100299015)(23010399003)(1800799024)(82310400026)(376014)(36860700016)(7149299003)(35042699022)(14060799003)(3109299003)(7049299003)(6049299003)(13003099007)(4053099003)(6133799003)(56012099006)(10067099003)(5023799004)(4076899003)(8096899003)(22082099003)(18002099003)(3023799007);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	6dc5xcPGIOPmdUFLyviPLPM0A5318QCFQO8iasFBjJvuxjJ7CCvT4wXkR9+9t++S/eCY0INiVrXgrGJI5GsXTWVGZ/ufpDRXep7agTIljMCHyzlXJMQ5E823DQmzd44mrdLL9W00SBVRfEBEGIvhCt+ocXpWjnw8v3Dksp3KQdaHLsq/5ZuCMF7aV5dMwcQu+7CIIpvhcf9xBHOioumtwQG90tp2gt8OzBbcCtLTcPWZxvDhXQCxzbi0/nHKawECwVdRhCIIAoVD4EWkv9TXpivdjc/6Wx3v4QMsM/99/DxNHWh434g1Yrds2A8+JWPFBHujxPXp+LJOW7nIVkYjYjGvXaCFLUaKNRL33YtT+IT/wnNJjRbbcNcdligbYzakhx7jQ3YYsP/DoCKdhsyRjKi/FN+/E9jZ/GsNxH9Jv+7tODtyhc/eiMRPkZAgMFjj
X-OriginatorOrg: castironradiatorcentre.co.uk
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2026 13:52:27.4596
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d95fe61a-46f5-4f7b-5294-08deebe64b85
X-MS-Exchange-CrossTenant-Id: 0415e796-cc04-4618-8152-6ecf37a22201
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=0415e796-cc04-4618-8152-6ecf37a22201;Ip=[52.17.62.50];Helo=[eu-dlp.cloud-sec-av.com]
X-MS-Exchange-CrossTenant-AuthSource: LO1PEPF000022FF.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CW1P123MB8020

--_004_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_
Content-Type: multipart/alternative;
	boundary="_000_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_"

--_000_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

Following the below failure of our vulnerability scan my developer (Surinde=
r Singh of IT Partnership) has requested that I send you the following.

We have investigated and reproduced the reported CGI Generic Path Traversal=
 (write test) finding affecting:
https://www.vintagedoorknobs.co.uk/products.asp

The report identifies:

  *   the sortby parameter using GET; and
  *   the xcode parameter using POST.

Our investigation indicates that this is a false positive.

GET sortby parameter
The application does not place the submitted sortby value directly into SQL=
 or use it as a file path.

The value is processed through a strict whitelist. Only the following known=
 values are recognised:

  *   2 - price, high to low
  *   3 - price, low to high
  *   4 - product name

Each recognised value is mapped internally to a predefined SQL ORDER BY exp=
ression. Any other value results in no custom sort expression being used.

We reproduced the scanner test by comparing:

sortby=3Dnot-a-valid-sort-value
with:
sortby=3D../../../../../../../../../../windows/system32/config/sam

Both requests were made using the same ASP session.

The results were:

  *   HTTP status: 200 OK for both
  *   Content length: 63640 bytes for both
  *   HTML response: byte-for-byte identical
  *   File comparison result: FC: no differences encountered

The only response-header differences were the expected Date and Expires tim=
estamps.

POST xcode parameter

The SecurityMetrics request submitted an xcode value while leaving the asso=
ciated xcmd command blank.

In the application code, when xcmd is blank, the submitted xcode value is d=
iscarded and replaced by the separate code parameter. As the scanner also s=
upplied a blank code value, the resulting command and product code are both=
 blank and the basket-operation routine exits without processing the submit=
ted xcode.

We reproduced this by comparing an ordinary invalid product code with the r=
eported traversal value, again using the same ASP session and leaving xcmd,=
 cmd and code blank.

The results were:

  *   HTTP status: 200 OK for both
  *   Content length: 63708 bytes for both
  *   HTML responses: identical apart from a dynamic page-execution timing =
comment
  *   Baseline timing comment: 0.063 secs
  *   Traversal timing comment: 0.043 secs

The response headers again differed only in their normal Date and Expires t=
imestamps.

The changing execution-time comment is expected dynamic content and does no=
t indicate file access. The scan evidence also shows similar minor executio=
n-time differences, without demonstrating any file access or modification.

Code review

Neither sortby nor xcode is passed to any:

  *   filesystem function;
  *   path-mapping function;
  *   file stream;
  *   dynamic include;
  *   operating-system command; or
  *   executable process.

There are no relevant calls to functions such as Server.MapPath, FileSystem=
Object, ADODB.Stream, Server.Execute, Response.WriteFile or WScript.Shell.

In legitimate use, xcode represents either a product code or a currency cod=
e. Product codes are used only in database lookups with SQL escaping and pr=
oduct-existence validation. Currency codes must match an allowed currency l=
ist or a record in the currencies table.

No file contents were disclosed, no file was modified, no filesystem error =
occurred, and the traversal value was not reflected in the response.

We also inspected the target file identified by the scanner. The Windows SA=
M file at C:\Windows\System32\config\SAM has a last-modified timestamp of 6=
 May 2026 at 04:11. The SecurityMetrics scan was performed on 24 July 2026 =
between 15:05 and 16:28. The file was therefore not modified during or as a=
 result of the scan.

We therefore believe the reported CGI Generic Path Traversal (write test) v=
ulnerability is a false positive. Please could this finding be reviewed man=
ually and marked as a false positive?

We can provide the response files, comparison results and relevant source-c=
ode extracts if required

Please can you reply accordingly.


Regards,

Paul Brown.

[CIRC Logo - Copy]
Cast Iron Radiator Centre (A Division of Mossmead Ltd)
241 Torrington Avenue
(Corner of Padstow Road)
Coventry
CV4 9AP

what3words
this.energy.bench<https://w3w.co/this.energy.bench>

Tel: 024 76 303999
email: paul@castironradiatorcentre.co.uk
WEBSITE: Cast Iron Radiator Centre<http://www.castironradiatorcentre.co.uk/=
>

Opening Hrs: Mon - Fri: 8am - 5pm
Telephone lines open: Mon - Fri: 9am - 4.30PM
Sat, Sun & Bank Hols: Closed

CONFIDENTIALITY NOTICE: This email and any attachments are confidential and=
 intended solely for the use of the individual or entity to whom they are a=
ddressed. If you have received this email in error, please notify the sende=
r immediately and delete it from your system. You must not disclose, copy, =
or distribute any part of this email if you are not the intended recipient.

DISCLAIMER: The views and opinions expressed in this email are those of the=
 author and do not necessarily represent the views of our company. The info=
rmation contained in this email is for general information purposes only. W=
hile we endeavour to keep the information up to date and correct, we make n=
o representations or warranties of any kind, express or implied, about the =
completeness, accuracy, reliability, suitability, or availability with resp=
ect to the email or the information, products, services, or related graphic=
s contained in the email for any purpose. Any reliance you place on such in=
formation is therefore strictly at your own risk.

VIRUS WARNING: Although we have taken reasonable precautions to ensure no v=
iruses are present in this email, we cannot accept responsibility for any l=
oss or damage arising from the use of this email or attachments. It is your=
 responsibility to ensure that your computer systems are adequately protect=
ed from viruses and other harmful code.

LEGAL NOTICE: This email does not constitute legal advice and is not intend=
ed to establish any attorney-client relationship. You should seek appropria=
te legal advice before taking or refraining from any action based on the co=
ntents of this email.

COMPLIANCE WITH REGULATIONS: Our company operates in accordance with releva=
nt data protection regulations. If you have any concerns about how your per=
sonal data is being processed, please contact our company using the above d=
etails.



From: SecurityMetrics Support Team <noreply@securitymetrics.com>
Sent: 24 July 2026 23:28
To: Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk>
Cc: Paul Brown (CIRC) <paul@castironradiatorcentre.co.uk>
Subject: PCI Scan Failed [www.vintagedoorknobs.co.uk]

[http://info.securitymetrics.com/l/47362/2017-06-16/583shx/47362/121679/SM_=
Logo_RGB_2015.png]


Hello Paul,

Your ASV Vulnerability Scan has failed for the following PCI Site Certifica=
tion:

Target: www.vintagedoorknobs.co.uk<http://www.vintagedoorknobs.co.uk/> SCID=
: 1972636

Your scan 13766852 failed to pass because one or more failing vulnerabiliti=
es were found. To view and resolve your failing vulnerabilities please log =
into your SecurityMetrics account.

Click here to log into your account<http://www.securitymetrics.com/login?ut=
m_source=3Dsystem-email&utm_medium=3Demail&utm_campaign=3Drenewal>

If you have any questions or concerns, please contact our 24/7 Technical Su=
pport team. You can email or call us at:

Email: support@securitymetrics.com<mailto:support@securitymetrics.com>
Phone: 801.705.5700 (USA)
Phone: 877.705.6070 (Canada)
Phone: 0203.014.7825 (UK)

Sincerely,

SecurityMetrics
Technical Support
www.securitymetrics.com<http://www.securitymetrics.com/>

This is a service message from SecurityMetrics, Inc., 1275 West 1600 North,=
 Orem, UT 84057.



--_000_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<title>%%subject%%</title>
<style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Aptos;}
@font-face
	{font-family:"Helvetica sans-serif";
	panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:"Helvetica-Light sans-serif";
	panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	font-size:12.0pt;
	font-family:"Aptos",sans-serif;}
h1
	{mso-style-priority:9;
	mso-style-link:"Heading 1 Char";
	mso-margin-top-alt:auto;
	margin-right:0cm;
	mso-margin-bottom-alt:auto;
	margin-left:0cm;
	font-size:24.0pt;
	font-family:"Aptos",sans-serif;
	font-weight:bold;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
span.Heading1Char
	{mso-style-name:"Heading 1 Char";
	mso-style-priority:9;
	mso-style-link:"Heading 1";
	font-family:"Aptos Display",sans-serif;
	color:#0F4761;}
span.EmailStyle22
	{mso-style-type:personal-compose;
	font-family:"Aptos",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;
	mso-ligatures:none;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:469254620;
	mso-list-template-ids:-1177640542;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1
	{mso-list-id:506289413;
	mso-list-template-ids:-884078184;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l1:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2
	{mso-list-id:1247956506;
	mso-list-template-ids:119591116;}
@list l2:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l2:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3
	{mso-list-id:1482623388;
	mso-list-template-ids:-1502574334;}
@list l3:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l3:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4
	{mso-list-id:1929340171;
	mso-list-template-ids:842060856;}
@list l4:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l4:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=3D"#E0E0E0" lang=3D"EN-GB" link=3D"blue" vlink=3D"purple" sty=
le=3D"word-wrap:break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US">Hi,<o:p><=
/o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US"><o:p>&nbs=
p;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US">Following=
 the below failure of our vulnerability scan my developer (Surinder Singh o=
f IT Partnership) has requested that I send you the following.<o:p></o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US"><o:p>&nbs=
p;</o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">We have investigated and reproduced the reported
<b>CGI Generic Path Traversal (write test)</b> finding affecting:<o:p></o:p=
></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><a href=3D"https://www.vintagedoorknobs.co.uk/products.asp"><sp=
an style=3D"color:#467886">https://www.vintagedoorknobs.co.uk/products.asp<=
/span></a><o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The report identifies:<o:p></o:p></span></i></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l1 level1 lfo1"><i><span style=3D=
"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;mso-ligatures:=
standardcontextual;mso-fareast-language:EN-US">the sortby parameter using G=
ET; and
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l1 lev=
el1 lfo1"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">t=
he xcode parameter using POST.
<o:p></o:p></span></i></li></ul>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">Our investigation indicates that this is a false positive.<o:p>=
</o:p></span></i></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-l=
anguage:EN-US"><o:p>&nbsp;</o:p></span></i></b></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-l=
anguage:EN-US">GET sortby parameter<o:p></o:p></span></i></b></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The application does not place the submitted sortby value direc=
tly into SQL or use it as a file path.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The value is processed through a strict whitelist. Only the fol=
lowing known values are recognised:<o:p></o:p></span></i></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l2 level1 lfo2"><i><span style=3D=
"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;mso-ligatures:=
standardcontextual;mso-fareast-language:EN-US">2 &#8211; price, high to low
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l2 lev=
el1 lfo2"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">3=
 &#8211; price, low to high
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l2 lev=
el1 lfo2"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">4=
 &#8211; product name
<o:p></o:p></span></i></li></ul>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">Each recognised value is mapped internally to a predefined SQL =
ORDER BY expression. Any other value results in
 no custom sort expression being used.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">We reproduced the scanner test by comparing:<o:p></o:p></span><=
/i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">sortby=3Dnot-a-valid-sort-value<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">with:<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">sortby=3D../../../../../../../../../../windows/system32/config/=
sam<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">Both requests were made using the same ASP session.<o:p></o:p><=
/span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The results were:<o:p></o:p></span></i></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l3 level1 lfo3"><i><span style=3D=
"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;mso-ligatures:=
standardcontextual;mso-fareast-language:EN-US">HTTP status: 200 OK for both
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l3 lev=
el1 lfo3"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">C=
ontent length: 63640 bytes for both
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l3 lev=
el1 lfo3"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">H=
TML response: byte-for-byte identical
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l3 lev=
el1 lfo3"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">F=
ile comparison result: FC: no differences encountered
<o:p></o:p></span></i></li></ul>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The only response-header differences were the expected Date and=
 Expires timestamps.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-l=
anguage:EN-US">POST xcode parameter<o:p></o:p></span></i></b></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-l=
anguage:EN-US"><o:p>&nbsp;</o:p></span></i></b></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The SecurityMetrics request submitted an xcode value while leav=
ing the associated xcmd command blank.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">In the application code, when xcmd is blank, the submitted xcod=
e value is discarded and replaced by the separate
 code parameter. As the scanner also supplied a blank code value, the resul=
ting command and product code are both blank and the basket-operation routi=
ne exits without processing the submitted xcode.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">We reproduced this by comparing an ordinary invalid product cod=
e with the reported traversal value, again using
 the same ASP session and leaving xcmd, cmd and code blank.<o:p></o:p></spa=
n></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The results were:<o:p></o:p></span></i></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l0 level1 lfo4"><i><span style=3D=
"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;mso-ligatures:=
standardcontextual;mso-fareast-language:EN-US">HTTP status: 200 OK for both
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l0 lev=
el1 lfo4"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">C=
ontent length: 63708 bytes for both
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l0 lev=
el1 lfo4"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">H=
TML responses: identical apart from a dynamic page-execution timing comment
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l0 lev=
el1 lfo4"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">B=
aseline timing comment: 0.063 secs
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l0 lev=
el1 lfo4"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">T=
raversal timing comment: 0.043 secs
<o:p></o:p></span></i></li></ul>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The response headers again differed only in their normal Date a=
nd Expires timestamps.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">The changing execution-time comment is expected dynamic content=
 and does not indicate file access. The scan evidence
 also shows similar minor execution-time differences, without demonstrating=
 any file access or modification.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-l=
anguage:EN-US">Code review<o:p></o:p></span></i></b></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-l=
anguage:EN-US"><o:p>&nbsp;</o:p></span></i></b></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">Neither sortby nor xcode is passed to any:<o:p></o:p></span></i=
></p>
<ul style=3D"margin-top:0cm" type=3D"disc">
<li class=3D"MsoNormal" style=3D"mso-list:l4 level1 lfo5"><i><span style=3D=
"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;mso-ligatures:=
standardcontextual;mso-fareast-language:EN-US">filesystem function;
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l4 lev=
el1 lfo5"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">p=
ath-mapping function;
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l4 lev=
el1 lfo5"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">f=
ile stream;
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l4 lev=
el1 lfo5"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">d=
ynamic include;
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l4 lev=
el1 lfo5"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">o=
perating-system command; or
<o:p></o:p></span></i></li><li class=3D"MsoNormal" style=3D"mso-list:l4 lev=
el1 lfo5"><i><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot=
;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-language:EN-US">e=
xecutable process.
<o:p></o:p></span></i></li></ul>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">There are no relevant calls to functions such as Server.MapPath=
, FileSystemObject, ADODB.Stream, Server.Execute,
 Response.WriteFile or WScript.Shell.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">In legitimate use, xcode represents either a product code or a =
currency code. Product codes are used only in
 database lookups with SQL escaping and product-existence validation. Curre=
ncy codes must match an allowed currency list or a record in the currencies=
 table.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">No file contents were disclosed, no file was modified, no files=
ystem error occurred, and the traversal value
 was not reflected in the response.<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">We also inspected the target file identified by the scanner. Th=
e Windows SAM file at C:\Windows\System32\config\SAM
 has a last-modified timestamp of 6 May 2026 at 04:11. The SecurityMetrics =
scan was performed on 24 July 2026 between 15:05 and 16:28. The file was th=
erefore not modified during or as a result of the scan.<o:p></o:p></span></=
i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">We therefore believe the reported
<b>CGI Generic Path Traversal (write test)</b> vulnerability is a false pos=
itive. Please could this finding be reviewed manually and marked as a false=
 positive?<o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US"><o:p>&nbsp;</o:p></span></i></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif;mso-ligatures:standardcontextual;mso-fareast-lang=
uage:EN-US">We can provide the response files, comparison results and relev=
ant source-code extracts if required</span></i><i><span style=3D"mso-fareas=
t-language:EN-US"><o:p></o:p></span></i></p>
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US"><o:p>&nbs=
p;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US">Please ca=
n you reply accordingly.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US"><o:p>&nbs=
p;</o:p></span></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black">Regards=
,</span><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black">&nbsp;<=
/span><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"color:black">Paul Brown.</span>=
</i></b><span style=3D"color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black">&nbsp;<=
/span><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black"><img bo=
rder=3D"0" width=3D"172" height=3D"59" style=3D"width:1.7916in;height:.6166=
in" id=3D"Picture_x0020_1682194979" src=3D"cid:image001.png@01DD1DD7.82A924=
40" alt=3D"CIRC Logo - Copy"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">Cast=
 Iron Radiator Centre (A Division of Mossmead Ltd)</span></i><span style=3D=
"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">241 =
Torrington Avenue</span></i><span style=3D"font-size:11.0pt;color:black"><o=
:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">(Cor=
ner of Padstow Road)</span></i><span style=3D"font-size:11.0pt;color:black"=
><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">Cove=
ntry</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">CV4 =
9AP</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">&nbs=
p;</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black">w=
hat3words</span></i></b><i><span style=3D"font-size:11.0pt;color:black"><br=
>
</span></i><i><u><span style=3D"font-size:11.0pt;color:blue"><a href=3D"htt=
ps://w3w.co/this.energy.bench" target=3D"_blank" title=3D"https://w3w.co/th=
is.energy.bench">this.energy.bench</a></span></u></i><span style=3D"font-si=
ze:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">&nbs=
p;</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black">T=
el:</span></i></b><i><span style=3D"font-size:11.0pt;color:black">&nbsp;024=
 76 303999</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:=
p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black">e=
mail</span></i></b><i><span style=3D"font-size:11.0pt;color:black">:</span>=
</i><i><span style=3D"font-size:11.0pt;color:black">
</span></i><i><u><span style=3D"font-size:11.0pt;color:black">paul@castiron=
radiatorcentre.co.uk</span></u></i><i><span style=3D"font-size:11.0pt;color=
:black">&nbsp;</span></i><i><span style=3D"font-size:11.0pt;color:black">
</span></i><i><span style=3D"font-size:11.0pt;color:black">&nbsp;</span></i=
><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black">W=
EBSITE</span></i></b><i><span style=3D"font-size:11.0pt;color:black">:</spa=
n></i><i><span style=3D"font-size:11.0pt;color:black">
</span></i><b><i><u><span style=3D"font-size:11.0pt;color:blue"><a href=3D"=
http://www.castironradiatorcentre.co.uk/" target=3D"_blank" title=3D"http:/=
/www.castironradiatorcentre.co.uk/">Cast Iron Radiator Centre</a></span></u=
></i></b><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">&nbs=
p;</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black">O=
pening Hrs:</span></i></b><i><span style=3D"font-size:11.0pt;color:black">&=
nbsp;Mon - Fri: 8am - 5pm</span></i><span style=3D"font-size:11.0pt;color:b=
lack"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black">T=
elephone lines open:</span></i></b><i><span style=3D"font-size:11.0pt;color=
:black">&nbsp;Mon &#8211; Fri: 9am &#8211; 4.30PM</span></i><span style=3D"=
font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;color:black">S=
at, Sun</span></i></b><b><i><span style=3D"font-size:11.0pt;color:black">
</span></i></b><b><i><span style=3D"font-size:11.0pt;color:black">&amp;</sp=
an></i></b><b><i><span style=3D"font-size:11.0pt;color:black">
</span></i></b><b><i><span style=3D"font-size:11.0pt;color:black">Bank Hols=
: Closed</span></i></b><span style=3D"font-size:11.0pt;color:black"><o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black">&nbsp;<=
/span><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">CONF=
IDENTIALITY NOTICE: This email and any attachments are confidential and int=
ended solely for the use of the individual or entity to whom they are addre=
ssed. If you have received this email
 in error, please notify the sender immediately and delete it from your sys=
tem. You must not disclose, copy, or distribute any part of this email if y=
ou are not the intended recipient.</span></i><span style=3D"font-size:11.0p=
t;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">&nbs=
p;</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">DISC=
LAIMER: The views and opinions expressed in this email are those of the aut=
hor and do not necessarily represent the views of our company. The informat=
ion contained in this email is for general
 information purposes only. While we endeavour to keep the information up t=
o date and correct, we make no representations or warranties of any kind, e=
xpress or implied, about the completeness, accuracy, reliability, suitabili=
ty, or availability with respect
 to the email or the information, products, services, or related graphics c=
ontained in the email for any purpose. Any reliance you place on such infor=
mation is therefore strictly at your own risk.</span></i><span style=3D"fon=
t-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">&nbs=
p;</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">VIRU=
S WARNING: Although we have taken reasonable precautions to ensure no virus=
es are present in this email, we cannot accept responsibility for any loss =
or damage arising from the use of this
 email or attachments. It is your responsibility to ensure that your comput=
er systems are adequately protected from viruses and other harmful code.</s=
pan></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">&nbs=
p;</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">LEGA=
L NOTICE: This email does not constitute legal advice and is not intended t=
o establish any attorney-client relationship. You should seek appropriate l=
egal advice before taking or refraining
 from any action based on the contents of this email.</span></i><span style=
=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">&nbs=
p;</span></i><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><i><span style=3D"font-size:11.0pt;color:black">COMP=
LIANCE WITH REGULATIONS: Our company operates in accordance with relevant d=
ata protection regulations. If you have any concerns about how your persona=
l data is being processed, please contact</span></i><span style=3D"font-siz=
e:11.0pt;color:black">&nbsp;<i>our
 company using the above details.</i></span><span style=3D"font-size:11.0pt=
;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:black">&nbsp;<=
/span><span style=3D"font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"mso-fareast-language:EN-US"><o:p>&nbs=
p;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:11.0pt;fo=
nt-family:&quot;Calibri&quot;,sans-serif">From:</span></b><span lang=3D"EN-=
US" style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> =
SecurityMetrics Support Team &lt;noreply@securitymetrics.com&gt;
<br>
<b>Sent:</b> 24 July 2026 23:28<br>
<b>To:</b> Paul Brown (CIRC) &lt;paul@castironradiatorcentre.co.uk&gt;<br>
<b>Cc:</b> Paul Brown (CIRC) &lt;paul@castironradiatorcentre.co.uk&gt;<br>
<b>Subject:</b> PCI Scan Failed [www.vintagedoorknobs.co.uk]<o:p></o:p></sp=
an></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div align=3D"center">
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" width=3D"100%" style=3D"width:100.0%;background:#E0E0E0;border-colla=
pse:collapse">
<tbody>
<tr>
<td width=3D"100%" valign=3D"top" style=3D"width:100.0%;border:none;border-=
top:solid #DDDDDD 3.0pt;padding:15.0pt 15.0pt 15.0pt 15.0pt">
<div align=3D"center">
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" width=3D"600" style=3D"width:450.0pt;border-collapse:collapse">
<tbody>
<tr>
<td valign=3D"top" style=3D"padding:0cm 0cm 0cm 0cm">
<div align=3D"center">
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" width=3D"100%" style=3D"width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td width=3D"180" valign=3D"top" style=3D"width:135.0pt;padding:7.5pt 15.0p=
t 0cm 0cm"></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr>
<td valign=3D"top" style=3D"padding:0cm 0cm 0cm 0cm;-webkit-text-size-adjus=
t: 100%;-ms-text-size-adjust: 100%">
<div align=3D"center">
<table class=3D"MsoNormalTable" border=3D"1" cellspacing=3D"0" cellpadding=
=3D"0" width=3D"70%" style=3D"width:70.0%;border-collapse:collapse;border:n=
one;-ms-text-size-adjust: 100%;-webkit-text-size-adjust: 100%" id=3D"templa=
teHeader">
<tbody>
<tr>
<td style=3D"border:none;border-bottom:solid #CCCCCC 1.0pt;padding:0cm 0cm =
0cm 0cm">
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr>
<td valign=3D"top" style=3D"padding:0cm 0cm 0cm 0cm;-webkit-text-size-adjus=
t: 100%;-ms-text-size-adjust: 100%">
<div align=3D"center">
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" width=3D"90%" style=3D"width:90.0%;border-collapse:collapse;-ms-text=
-size-adjust: 100%;-webkit-text-size-adjust: 100%" id=3D"templateBody1">
<tbody>
<tr>
<td valign=3D"top" style=3D"background:#E0E0E0;padding:0cm 0cm 0cm 0cm">
<h1 align=3D"center" style=3D"margin:0cm;text-align:center;mso-line-height-=
alt:19.5pt">
<span style=3D"font-size:19.5pt;font-family:&quot;Helvetica sans-serif&quot=
;,serif;color:#666666"><img border=3D"0" width=3D"250" height=3D"51" style=
=3D"width:2.6in;height:.5333in" id=3D"_x0000_i1026" src=3D"http://info.secu=
ritymetrics.com/l/47362/2017-06-16/583shx/47362/121679/SM_Logo_RGB_2015.png=
"></span><span style=3D"font-size:19.5pt;font-family:&quot;Helvetica sans-s=
erif&quot;,serif;color:#666666"><o:p></o:p></span></h1>
</td>
</tr>
</tbody>
</table>
</div>
<p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span s=
tyle=3D"display:none"><o:p>&nbsp;</o:p></span></p>
<div align=3D"center">
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" width=3D"90%" style=3D"width:90.0%;border-collapse:collapse;-ms-text=
-size-adjust: 100%;-webkit-text-size-adjust: 100%" id=3D"templateBody">
<tbody>
<tr>
<td width=3D"70%" valign=3D"top" style=3D"width:70.0%;background:white;padd=
ing:22.5pt 22.5pt 22.5pt 22.5pt">
<p class=3D"MsoNormal" style=3D"margin-bottom:37.5pt;line-height:15.75pt"><=
span style=3D"font-size:10.5pt;font-family:&quot;Helvetica sans-serif&quot;=
,serif;color:#666666"><br>
</span><span style=3D"font-family:&quot;Helvetica-Light sans-serif&quot;,se=
rif;color:#666666">Hello Paul,
<br>
<br>
Your ASV Vulnerability Scan has failed for the following PCI Site Certifica=
tion:<br>
<br>
Target: <a href=3D"http://www.vintagedoorknobs.co.uk/">www.vintagedoorknobs=
.co.uk</a> SCID: 1972636
<br>
<br>
Your scan 13766852 failed to pass because one or more failing vulnerabiliti=
es were found. To view and resolve your failing vulnerabilities please log =
into your SecurityMetrics account.
<br>
<br>
<a href=3D"http://www.securitymetrics.com/login?utm_source=3Dsystem-email&a=
mp;utm_medium=3Demail&amp;utm_campaign=3Drenewal"><b><span style=3D"color:#=
2196F3">Click here to log into your account</span></b></a>
<br>
<br>
If you have any questions or concerns, please contact our 24/7 Technical Su=
pport team. You can email or call us at:
<br>
<br>
Email: <a href=3D"mailto:support@securitymetrics.com">support@securitymetri=
cs.com</a>
<br>
Phone: 801.705.5700 (USA) <br>
Phone: 877.705.6070 (Canada) <br>
Phone: 0203.014.7825 (UK) <br>
<br>
Sincerely, <br>
<br>
SecurityMetrics<br>
Technical Support<br>
<a href=3D"http://www.securitymetrics.com/">www.securitymetrics.com</a> </s=
pan><span style=3D"font-size:10.5pt;font-family:&quot;Helvetica sans-serif&=
quot;,serif;color:#666666"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr>
<td valign=3D"top" style=3D"padding:0cm 0cm 0cm 0cm;-webkit-text-size-adjus=
t: 100%;-ms-text-size-adjust: 100%">
<div align=3D"center">
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" width=3D"90%" style=3D"width:90.0%;border-collapse:collapse;-ms-text=
-size-adjust: 100%;-webkit-text-size-adjust: 100%" id=3D"templateFooter">
<tbody>
<tr>
<td valign=3D"top" style=3D"padding:0cm 15.0pt 30.0pt 15.0pt;-webkit-text-s=
ize-adjust: 100%;-ms-text-size-adjust: 100%">
<p align=3D"center" style=3D"text-align:center;line-height:11.25pt"><span s=
tyle=3D"font-size:7.5pt;font-family:&quot;Helvetica sans-serif&quot;,serif;=
color:gray">This is a service message from SecurityMetrics, Inc., 1275 West=
 1600 North, Orem, UT 84057.<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</div>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><br>
</span><span lang=3D"EN-US"><img border=3D"0" width=3D"1" height=3D"1" styl=
e=3D"width:.0083in;height:.0083in" id=3D"_x0000_i1025" src=3D"http://url476=
4.securitymetrics.com/wf/open?upn=3Du001.5tb61hZtmdNQ-2B5AW-2Far1s06qARMctj=
WVNUAb7JndsVSCnrdX-2BFs41xPGEMSngI0gdKb0K0eQCLdM7Yr8hNejemCyvMaqxBCC2Jcq3WS=
9hnASlDHjY-2BsD2MIQC6QzG26R9puiFUZFZyd8-2F1S5HcN5L1wX6ewZSQvJ3zrjE8uUp7EyqC=
NWvqWWau7HEJwQe0qv4-2B0Z9luHVe2sGiNW8wtATG1txrzW4bsh3EkrXZLDQS8-3D"></span>=
<span lang=3D"EN-US"><o:p></o:p></span></p>
</div>
</body>
</html>

--_000_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_--

--_004_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_
Content-Type: image/png; name="image001.png"
Content-Description: image001.png
Content-Disposition: inline; filename="image001.png"; size=5674;
	creation-date="Mon, 27 Jul 2026 13:52:15 GMT";
	modification-date="Mon, 27 Jul 2026 13:52:15 GMT"
Content-ID: <image001.png@01DD1DD7.82A92440>
Content-Transfer-Encoding: base64

iVBORw0KGgoAAAANSUhEUgAAAK0AAAA7CAYAAAAJkAodAAAAAXNSR0IArs4c6QAAFeRJREFUeF7t
3QOQJEvXBuDca9u2bdu2bdu2bdu2bdu2bd8vnvrjTNTU1nRXz/TMzt6/T8TEbk9nZSXePPkeZE6f
f//999/UktYI9Ecj0KcF2v5otlpNzUagBdoWEPq7EWiBtr+bslaDW6BtYaC/G4EWaPu7KWs1uAXa
Fgb6uxFogba/m7JWg7sNtJ988kn6+OOP0xtvvJG++OKL9Oeff6a///47DTzwwGnYYYdNE000URp9
9NHTZJNN1iOzcP/996ebbropffTRR+mvv/5KAw00UJp00knToosummafffYO2/DCCy+k2267LT37
7LNZ+z2n/UsvvXRaYoklOnzu7bffTtdcc0167rnn0i+//JIGGWSQ7DnPLLfccu2ee++995LyytSS
P/74I0088cRpnHHG6avYa6+9loy58SXKzjzzzGmYYYbJ2n3XXXelIYYYot1zffr0SYMPPngabbTR
0phjjlnz3fpw8803Zz+///57+ueff7L2zjXXXGmhhRZKE044YV99euedd7L2GO/JJ588ew8xB6+/
/npbf9U3wwwzpBFGGKESFpoK2k8//TTdcccd6ZZbbkkjjjhiGnfccbPBGG644dLQQw+dBhxwwGwC
v/nmm/T1118nnQLoCSaYIC2zzDJpxhlnrNToRgqde+65aYMNNqj5iHZdfvnlacUVV2wr9+CDD6aV
Vlopa18t2X333dMhhxzSVuStt95Kiy++ePJvLdl1113TwQcfnI3JXnvtlf2/iniXdxZl5ZVXTldd
dVW7X999991pgQUWyMZ6pJFGqlv9NNNMk/bdd9+0wgortCu77LLLphtuuKHm81NPPXW2SCkjsvPO
O6ejjjqq3TMRxzrggAOy9+Tl+uuvzzBQRZoCWhN0+umnpy+//DLTXAZq1FFHrfL+9PPPP6dnnnkm
04KfffZZBpyqja/3guuuuy4tv/zy9Yq1ff/II49kWtdiKmqOWpVsuumm6bTTTss0Gm2qT1Vkhx12
SEcffXQGWMCtIsccc0zafvvt+yq64YYbpnPOOafd7y08mvC7775Lww8/fJXqszJLLbVUuvHGG7P/
09ZPPfVU5WcDmPvvv3/ab7/92j231VZbpRNPPDHr80477dTuu9tvvz0tssgild7TJdCaJANukjfa
aKNsgLoitrezzz472zp0arrpputKdZl2oCXyghLYXtGW999/v913Dz/8cJpjjjnSu+++m2n/vIwy
yihpqqmmSj/88ENfk6jvZ555ZkaBLNZvv/227dGhhhoqGxfa7sknn2xX5y677JIOP/zwdNBBB6W9
9967Ul9NOLAXpQy0Dz30UJpzzjlLQUvDW2Dff/99ttjyQunQ0sQifuyxx9p9P/fcc2dbu9/nFygq
gJaQMtD6PcV22WWXpa233rrnQfv8888nap4mW2uttSoNeNVCAHXYYYdldGHLLbes+lhf5WiLotZG
XWzfp5xySl91h6bFMccff/x29WnHSSedlPS7uJg23njjdMYZZ2SgxdvQn5Dpp58+20lMFuDnBUXQ
z9C0KNSPP/5Y2t/4zpa74447dhm08847b7rvvvvSq6++mqaYYop29S288MIZzSNAb1zyEtqUZrzz
zjvbvqoC2tlmmy3ttttuffH6bte0V155ZcafbFX1CHynEZdStihogiOPPDINMMAADVdVBlrtRkFM
Pt6Vl1qgxYvtAo8++mimjfNSC7S4HmOujHIEaPN1lVEFvHy99dar2f9GNa0+2Fm6AlrAf+CBBxoC
rcKMUcojL90KWrzp8ccfz7hJPWu3YZSVPHD++ecn29ypp56aWe6NSBloLTgGVm8F7RFHHJGAOS/R
5lp97yxoX3755Yz25KWqpu0saMv60W2gZeExmDoDoEbAViwLuFxOxx13XEPV9CbQlmm0oBz5TqEL
Re8ADrjqqqt2i6b9T4P2lVdeySzcK664omGN1xDSOijMYGE8FK3OWnX3JtCiOVxC4Uflm+RiYp3/
fwGtvuP9PaZpV1lllWTrGm+88UpfSpNMMskkGbDIm2++mbmNgotynrPaY9J8P8YYY6QhhxwyK8+S
F2yoRTlYnAw/1m0VqQXaQw89NO2xxx7tqgkXUZkh1llOy5hsxGX0X9a0F110UYdGe9PpATcL63WT
TTYpxUrwMI5lYAzLXHABAPhwN9tss8xoEw0J/6lojGADMo8fkd9++y0NOuigpe9R15577pnOO++8
NvB3VtNeeuml6ayzzmpbNDThySefnPG7MtCGL5YnoBgEqWWIaZ/dYZ999snGsJ70FGi54SxSyiQC
AtG27uK0jFhGJU9LUZoKWu4bWgbQOhJuHeFKwh3CMtXAss+//vprFnG59dZbs+8ZdVdffXWmxYmQ
qQBFR4JP08YMj3pSS9PWerYMtEsuuWTme3ziiSfSFlts0e7xAK2+c+JbAGWy9tprZx6XWtGpngKt
Obv44ouz/hQ9E3yz4eaq5fJq1BAz54sttlgSPu5W0JoovrVaQPI98AVIOZ9Z/GWfcRpU49prr82+
t3Uy8A488MDsc3SsI1DhggBrtRZj6cVnmgnaWiAP0CpjR7Gz1BJ+ba6tshyCngJtR+1D555++uk2
X3QzQWs+RNvK3HpN07SiG5I7ij61YofrgXaeeebJtiJSBK0BosUDtPU0rTq422i0ekGNfgFa7RNI
EO1CY2qJfght5qVfg1aSE1sjpDtAW+ZubBpobR84Zr2tuKdB+8EHH2R0QoSqltQCrZDxhx9+2Gb4
oS34rKyoMnpQVdPmy0kgEhg59thjSx+P3IPeBFqJTiKSkXHVHaA1JhZ1XpoGWsaHkCGvQC3padBq
y7bbbpsljnTkzVCmFmjLMo2ENfG0MtAKSHC7oTNFn2meHpSNkx1LWxmoeSmLiPWUpp122mmznQB3
LYbKI8Srrf0VaGkeoL3gggtqAtaX/QK0LP2xxx67ZkZYo37aSJgpAy3PCa4KtEXfaj3QBi2SPBMJ
JX7XL0HL7uC1Keur/NjIKeivQPvSSy9lK7GYE1mG4H4B2nvuuScDUHGbybevUdB2NfeAkchgteD5
qyU/8z0zNHlhJNPknev9ErSRe9CTEbEwxLqNHrDiJXlUybLqF6AVjKBtw1VWtph6GrS0KC6YT9dz
MkPgpQXa/6NrvAfdBlpalj90jTXW6JX0gIGI1wJuR4k0PQ3astTEyPJqgbYHQCsK5tzO/PPP3ytB
q1HrrrtudmJAZK2qpuVekxgu+aZ4AqCr9KAMtAwegZeffvopO4LUWzhtM+gBbDBeQ+rl03a7puU3
xc9mmWWWXgtaESbGUUdBhjJNy/20+uqrZ1uUhZmX7gAtzwsftfC2nIn/AmglTzEqeVRE1ELszHg9
KTu50O2gZYDNNNNMab755uu1oK2naUXdiof0anXGiV2BkM4mzJgwnFY+RRXZbrvt+vLh9pTLq6qm
dUrDaY2qUuuMWLeDVmKDbXe11Var295+YYgBSHDayCwrNtSJAXH0KiCSzMMbwcIvOyO2zjrrJHm9
3GLFs3CRAeb9ZadiOxpAaZ7K58VpW0lBebnkkkuy3aGWWMBF92QsQmfWisez7aBC77xEeHdebPu8
M6SMRnXUDvkZ8q2JBKGIckb5OHFbtjDrhe/z7+zwYKPz7Sz0YnJIWYP7BWireA+irSiEgRJJc14/
RDaZ9EkpimuuuWbb72naOBkquYMLS76E3UcyOtoUp1t9J9iAboTwfzqoqGzxzBcXGIA5J+VgYVFO
OOGELIhh+yWSbyQJ1TtVLAjkhEPwewtV/i6fsjqceRt55JGzOlEUubxAxOWFtjjmTygDvlnR0BBe
JMEYIfbPP/+8XZM954yZNqozxHgcf/zxbVl0xoEiNHaCLPIPoo++s+D4h6tIh6B98cUX04UXXljT
pRQvaCZoObVFZOKiB6ApHjL03ip+2uIAGHBWPKNImiCtGpNVZbAaLcMws7iAZrDBBssmSbpm/yzm
xfjpm0Xn1HJnzu91ZQw6BC3089GWRcQA2nZJk5BmgpaWcv8BzUZw6nvvvbevPlqtY401VtPuSOjK
ILae7dkRqHnvgdClbax4B0Cc0w/SXSsVUZlGsrzirL6LHmRBuS+gTBgxOG2ZFu7ZIWy9radHoCZo
Q8vSqnmJ1LJIABGVwgMJkBZB3Aho5aOyWBkfXCvS/IqCm+JMQF1LUAGZVhF8YLChA8UkbDuHjC9h
V1ue9wffdEdWJC37F61g1MTpCkYbHqjfcdzI9skItOA8Y0fgr/V/2WVufMkbj3i2epUjntUel2h4
F0NJe3x2kUk8a1v2HH5ddtpDZI7lH+2Qq6Euz+HibgbKH29SP34qPRGlwY8pBadN7LzaOeWUU2Zz
LbiTT+b2HT+08ZUlFseqtFXmHD4d5fHofEAI1fCeOHpVbxHUBK2O8cUxyspAW1a5ycvfSuLzrLPO
2ubPYwRwQ4WVyYJlEOTvw4p643hO8T2iYAaCn7aW4L3OJZl4fTFoJoxf1+LAaRkYjBbtNHgmyoSw
6lET2twzvgdOk+HHQhSksIDxVmX834RpX9RjcrzXM+6vcusNCmSC1BmGnpMEThA4POr9JNqj7dJD
AU571A1gxhLovIMLK38XmTxl9zTg0uoDHj/KeoeFw1h0gYh2+DEOjFbRUJ4U7+DL5uXwWf/1jbFI
cehTvg8MKVTRaWKKQfvi0j5t1j8X0bmRx/yFaIs7KHxXRepei6RjDKO8ZReaNuiBM0Vu5QtNm8/e
V8YZqXDk6wRLN46Du+ANsOKqH0TfqrP9czHlrxhSv4FYf/31s8EN67OjjqIaLGoTBxSuNAIwk2Mx
0n6AZEBpOXkCLGRtpm25mbifABLIaBmLjFbhBXDQ0iTSTMCHNnmn40MAwlLGz+UemHAT43s/NKd6
1UWLeZ+bGNURGo7m5mtWzjEVVj5A0Ko0rEmOK4vUl08e4kKyaAHL/Nl1aF27iXYDL0UBtMbUArE4
7F6OrNP2REK4mxpFvvQh8pjtGMZV28ypPnCVUVhcXdojbVRf1GVMtV8/RCJ9ry3eC7R+V/UGzbqg
tT1vvvnm7W7ki4SH/F9zQiEAL64M8gztIEChnAx9GnbBBRfMBoPGoB0iN9Xql4QdfmF1OXgIaHlx
ZxaRDlhPArQGFTcHILcj+szQo7mA1sQ6rGhAfTah2k3bhs+U1uf+U4+JstXqYxG0ompusaHd+Cpt
53aqGAMgsPVadEAA3OoxiRaoxW0BmGDa3GTSSm5lAT6g1T4L2xjIFPPZ1py/48u1Rn7U5RntiOP/
xt7vgdauw70HbNpMQzr0iTLR4oAM2ICF9lhU+gJw7A7tBnoRMMJDA9jqdepFfTSzRU/x+dEnn+10
+mCO0YqgFPXmtS5oVcBvqOE0HInj1935J8hsJVZ8bJXei+fFMZaOTuzmO5wHLc1Nq8s9MOBF0NLE
BtREAlIRtAZYfjEgVgUt/y+6ENob6MOo9Z64t9aCVSeNLcwMUAAqiAGUtGoRtM6XhaFssmuB1s6G
v9oBADwPWtqSDzgfMAnQxvZvno2JxYZOxaliGhv1oi2D3tnJ7MRA6c40oI1Qex60QG1MixfR1QOs
7yuBVkHbqS3dNmo1OXpcvNOqygurlkH+aZ58tAbwTF7VKyHzoLW6tdt2W6ZpgVa9NEmzQEtL03BF
0Hq/YActRpvRhADSKGjRMIu4CmgZtTStvqEpngE0oMWF83MZoAVwFMzW3xnQmiugldQEpGikndZc
+GzXqZL6WsRMZdDyyZpQHLGnnckabcHQurbnqhKgxRsNFHpA09rOLEJADXqA1jC8aAn966qmjSM2
DBb8krYKTdsM0OKLwsdsjvAi5McmTw9oVqDDrWlxhvFXX32V7aC0pnEQGbR7URIBWjuShYGysP4b
0bRAKXfWto/mWRx2D0A2FxaD7ygK1IPHqapUBq0KaSmDIWTXkyKkyAAC3EYWDNDSLrawcEvRbOqI
tERGgwH0PTCF1d9V0OJ6tn/vMmERrEEPugravPdA3dpuK84nN+VBa7EU/dncVrin+3RxVe1DOVCa
AC0lYXwoKllq+lOVHqArQe0sBu/wLNoQhpiFjc9aDKKvVaUh0KqUb5afDbnuKFGl6surlANYF/za
Yhq9pTFAawD5LAFIm21ZBs4Kt3sEaE0+zWOwmwFaQLDFAlmzQUsLaicQWAQ0IuMwJA9avNEY2Glo
WqFk9IumNRZhH+CYjOc8aBlYlBV/NTrTKGjtMOq3uBiK/g3jUluMPdAWk2tqYaNh0KqMgWSbBdzi
RcFVgFi1DE1gcG1PVS3LMkPM71joOK07HOKWG8kkee8BQ0EiRzPogQVg6zbZ3tlMemAsAJTHBogs
RGDI3yaeBy2XI3cX16KyygFScFpGKcoQ0gzQWkyRWBSnYFAAbj2gtZBpdoutUekUaL2Ef5Dry3Gc
vFO70QaUlbd18VDw25X9fYGq78gbYlZ5GGK0FFcbF1uAFq9jKMQf7+iqpqUFO/IedJUe0N4x4VUN
Md4DWV+e3WabbdpcXsDONZXnlM0CLf6KC9udgbhoiKEm2tKodBq0XmRibK+2He6XKqccajVQuNGl
zaI5PAWiK12RMu9BZ11eLN3w09JWVfy0XQEtfspPy11V5qcFWi44LrF63gPA5nrjPy66vGg8oC1z
eZnfztKDKi4vnig7YKPSJdDGy3BcTn+kWiIwK7HKnwDyPDIuYiKrnRvN30iIDK9GO1Ms3yw/Le6F
E7J05UTY6g04ENcKLjQKWlSIsQlYzufR/j4DVhhaEVyoB1o3tohSWmByhdUdid20GwqEHsQ80f5o
EyoWEbHuBC1DNXKbuTYFn/wRlyrSFNDGizj/8TeDg+uyWIU7TTgL3mQg3TSqsKIti8PfdyhGrT9C
V6UzxTJCj0BmQmgkyTO0DXpgIoVxAwToQETETDSOpwxa4XOEKmk9fBW1wMfcgsitpQwObqHYXgGA
lsJp488b2T2ERNUlmsQ4tD37PyNTaNQzXEEc9t7j/9xTXHTCpNEeLi8GljqNK/Dl79uVl8zqN7Ys
d9oYjwUQnBZgUKNi7oFFKFGKi9P70TQeGH5efdLHyBuQQyBZR3+MAxGGR7FoWgpI/WwfLjB0wRgb
t6iDAmAQ21GaFsbtDFg8IzLCWc65DqQmyESwFv1w/dAW4vllVz929r3553BjWtwE2WrtBAbfIAMs
a9nk0jrCtADFUxERLz5LgYFon4nXdtTAYiSuNDXonqGJAdg7LQwg0/fwj1qUQGSi5AjbZQBOufDE
8DJY9OpRBzCiSdqmPO2pPepBx/iAIzei6OuUgWYRRZYXr4FdENCA13GcOBQaoVk7JaPNAjJOeKid
lD2gPYyr8OJI/rHoPBu3aka9ygCh8RLa9lkf/FjE+YgmjS64UXV3bqqmbQbQWnW0RqDeCLRAW2+E
Wt/3uhFogbbXTUmrQfVGoAXaeiPU+r7XjUALtL1uSloNqjcCLdDWG6HW971uBFqg7XVT0mpQvRFo
gbbeCLW+73Uj8D8WwKqLT4nVEQAAAABJRU5ErkJggg==

--_004_CWLP123MB5865729D0216B864AE957F20E2CC2CWLP123MB5865GBRP_--