UI REDRESSING in craigk5n/webcalendar


Reported on

Jun 25th 2022


The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Proof of Concept

1) Go to this URL: http://web.clickjacker.io/test?url=http:%2F%2Fwebcalendar.sourceforge.net%2Fdemo%2Flogin.php

2) Observe that the website is getting embeded in an Iframe.

3) Observe that the headers x-frame-options and content-security-policy frame ancestors are missing.


Users are tricked into performing all sorts of unintended actions are such as typing in the password, clicking on ‘Delete my account’ button, liking a post, deleting a post, commenting on a blog. In other words all the actions that a normal user can do on a legitimate website can be done using clickjacking.

We are processing your report and will contact the craigk5n/webcalendar team within 24 hours. a year ago
A GitHub Issue asking the maintainers to create a SECURITY.md exists a year ago
We have contacted a member of the craigk5n/webcalendar team and are waiting to hear back a year ago
We have sent a follow up to the craigk5n/webcalendar team. We will try again in 7 days. a year ago
craigk5n/webcalendar maintainer has acknowledged this report a year ago
Craig Knudsen validated this vulnerability a year ago
tharunavula has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Craig Knudsen marked this as fixed in master branch (will be included in 1.9.2 when released) with commit bb7c65 a year ago
Craig Knudsen has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation