<div dir="ltr"><img src="cid:ii_krl5889a0" alt="Capture.PNG" width="497" height="336"><br>Hello team,<br>Hope you are fine. I am a security researcher and have found some bugs/vulnerabilities in your website.<br><br>BUG TYPE: CLICKJACKING<br><br><br>In the index (home page): <a href="https://website.com/login">https://website.com/login</a><br>Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.<br><br>Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of style sheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.<br>PoC:<br><html><br><head><br><title>test nbxsites </title><br></head><br><body><br><p> <a href="https://website.com/login">https://website.com/login</a> is vulnerable to clickjacking!</p><br><iframe src="<a href="https://website.com/login">https://website.com/login</a>" width="500" height="500"></iframe><br></body><br></html><br><br>IMPACTS:<br>Tricking a user into unknowingly;<br><br>No.1: An attacker can gain access to the credentials of users and use those credentials for booking and payment.<br><br>No.2: adding events to their profile they are interested in attending.<br><br>No. 3: editing their star rating on reviews;<br><br>No.1: bookmarking unwanted business<br><br>PROOF:<br><br>ss<br><br>Best Regards.<br>Found More bugs on your website reply to me so that I may disclose them further<br></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br>
<table style="border-top:1px solid #d3d4de">
<tr>
<td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td>
<td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free. <a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a>
</td>
</tr>
</table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div>