Jump to content
kingsleymensah

Vulnerability report (click jacking)

Recommended Posts

Hi guys, i received an email from someone claiming to be a pentester and he says he found a vulnerability in  my WHMCS

Here is what he sent:

"I am a security researcher and I found this vulnerability in your website
https://kingscel.com/  
Bug type : UI Redress
Impact :  Phishing (account compromise)

Description :
Click jacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.

Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.

POC:

<html>
<head>UI REDRESSING</head>
<body>
<h1>WEBSITE IS VULNERABLE TO UI REDRESSING</h1>
<iframe width=100% height=80% src="https://mydomain/whmcs/clientarea.php"></iframe>
</body>
<html>

Impact:
Any User can be lured in to click on whats look like a functionality of the website but is actually an attackers frame button containing some malicious javascript code or redirection code leading the user to a vulnerable site . And as the vulnerability persists even after the user is logged in which makes it even more sever.

Suggested Fix:
Add an iframe destroyer in the page headers.

Please let me know if any more info needed !
Waiting for your reply and hopefully a  bug bounty for responsibly reporting the issue ...

Note:  
i am attaching a screenshot as proof of concept waiting for your response."

 

Note: he just took a screenshot of my client area login page

 

Should i be concerned?

Share this post


Link to post
Share on other sites

He's looking for reward. I've seen these sent to forums, plain HTML sites, Wordpress and more, though "iframe breaking" is a new angle. 
Ignore, and block the sender, he won't quit asking for money.

Share this post


Link to post
Share on other sites
Just now, bear said:

He's looking for reward. I've seen these sent to forums, plain HTML sites, Wordpress and more, though "iframe breaking" is a new angle. 
Ignore, and block the sender, he won't quit asking for money.

ahhh..... thanks man. On it now!

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use & Guidelines and understand your posts will initially be pre-moderated