| عنوان | i-diario i-diario login system 2.9 Clickjacking |
|---|
| الوصف | A Clickjacking vulnerability was identified in sensitive pages of the application, such as the login page. The server does not return security headers like X-Frame-Options or Content-Security-Policy with the frame-ancestors directive, allowing the application to be embedded within iframes on external domains. This can be exploited by an attacker to trick users and perform unauthorized actions.
Summary:
The application does not implement protection mechanisms against Clickjacking. This allows legitimate pages to be embedded within malicious iframes, leading users to interact with invisible or disguised elements, which can result in session hijacking, unintended actions, and other attacks.
Details:
Affected URL: https://192.168.100.226/login
The HTTP response from the page does not include the following headers:
X-Frame-Options
Content-Security-Policy: frame-ancestors 'none';
Tested URL: https://192.168.100.226/login.php
Application HTTP Response:
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
...
Missing headers:
X-Frame-Options
Content-Security-Policy: frame-ancestors 'none';
This absence allows the application to be embedded within <iframe> elements on third-party websites. |
|---|
| المستخدم | princival (UID 88631) |
|---|
| ارسال | 03/08/2025 06:49 PM (1 سنة منذ) |
|---|
| الاعتدال | 17/08/2025 10:38 PM (14 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 320430 [Portabilis i-Diario حتى 1.5.0 Login Page تجاوز الصلاحيات] |
|---|
| النقاط | 17 |
|---|