| Título | i-diario i-diario login system 2.9 Clickjacking |
|---|
| Descrição | A Clickjacking vulnerability was identified in sensitive pages of the application, such as the login page. The server does not return security headers like X-Frame-Options or Content-Security-Policy with the frame-ancestors directive, allowing the application to be embedded within iframes on external domains. This can be exploited by an attacker to trick users and perform unauthorized actions.
Summary:
The application does not implement protection mechanisms against Clickjacking. This allows legitimate pages to be embedded within malicious iframes, leading users to interact with invisible or disguised elements, which can result in session hijacking, unintended actions, and other attacks.
Details:
Affected URL: https://192.168.100.226/login
The HTTP response from the page does not include the following headers:
X-Frame-Options
Content-Security-Policy: frame-ancestors 'none';
Tested URL: https://192.168.100.226/login.php
Application HTTP Response:
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
...
Missing headers:
X-Frame-Options
Content-Security-Policy: frame-ancestors 'none';
This absence allows the application to be embedded within <iframe> elements on third-party websites. |
|---|
| Utilizador | princival (UID 88631) |
|---|
| Submissão | 03/08/2025 18h49 (há 1 Ano) |
|---|
| Moderação | 17/08/2025 22h38 (14 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 320430 [Portabilis i-Diario até 1.5.0 Login Page Elevação de Privilégios] |
|---|
| Pontos | 17 |
|---|