September 2025 - Securityannounce

Re: IvorySQL- Clickjacking and the missing DMARC record

by Kunal Mhaske

Hello Xueyu, Thank you so much for the response. Any reward for these valid vulnerabilities? Please let me know. Thanks & Regards, Kunal Mhaske On Wed, Sep 17, 2025 at 7:10 AM xueyu gao <gaoxueyu2024(a)gmail.com> wrote: > including " securityannounce(a)ivorysql.org" > > On Wed, Sep 17, 2025 at 9:29 AM xueyu gao <gaoxueyu2024(a)gmail.com> wrote: > >> Dear Kunal Mhaske, >> Thank you very much for bringing this issue to our attention. I'm very >> sorry, but I'm not sure why you haven't received the emails. I've replied >> several times, and my responses are also in the email thread. Thank you for >> your continued attention.The problem has already been resolved. If you >> have any further questions, please feel free to contact us. >> >> -----------------Following are the previous email at >> July------------------ >> It seems that you may not be receiving my messages, so I’ll reply to you >> via my personal email (gaoxueyu_hope(a)163.com and gaoxueyu(a)highgo.com) I >> am the maintainer of the IvorySQL community, and you are welcome to reach >> out to me directly with any questions. Thank you very much for your support >> and understanding. >> >> The issues you mentioned — Clickjacking and the missing DMARC record — >> were indeed valid, and both have now been fixed. >> >> You can subscribe to the mailing list to receive notifications promptly.🙂 >> https://lists.ivorysql.org/postorius/lists/ >> [image: image.png] >> [image: image.png] >> Best regards, >> Hope Gao >> IvorySQL Project Maintainer, HighGo Software，Tel:15588680887 >> >

Sept. 17, 2025

Re: IvorySQL- Clickjacking and the missing DMARC record

by xueyu gao

including " securityannounce(a)ivorysql.org" On Wed, Sep 17, 2025 at 9:29 AM xueyu gao <gaoxueyu2024(a)gmail.com> wrote: > Dear Kunal Mhaske, > Thank you very much for bringing this issue to our attention. I'm very > sorry, but I'm not sure why you haven't received the emails. I've replied > several times, and my responses are also in the email thread. Thank you for > your continued attention.The problem has already been resolved. If you > have any further questions, please feel free to contact us. > > -----------------Following are the previous email at July------------------ > It seems that you may not be receiving my messages, so I’ll reply to you > via my personal email (gaoxueyu_hope(a)163.com and gaoxueyu(a)highgo.com) I > am the maintainer of the IvorySQL community, and you are welcome to reach > out to me directly with any questions. Thank you very much for your support > and understanding. > > The issues you mentioned — Clickjacking and the missing DMARC record — > were indeed valid, and both have now been fixed. > > You can subscribe to the mailing list to receive notifications promptly.🙂 > https://lists.ivorysql.org/postorius/lists/ > [image: image.png] > [image: image.png] > Best regards, > Hope Gao > IvorySQL Project Maintainer, HighGo Software，Tel:15588680887 >

Sept. 17, 2025

Re: Bug Report(Clickjacking)

by Kunal Mhaske

Hello Team, Please give me a response regarding this Bug Report, Please. On Mon, Jun 16, 2025 at 11:19 PM Kunal Mhaske <kunalmhaske0050(a)gmail.com> wrote: > Hello Team, > Please give me a response regarding this Bug Report, Please team. > > > On Wed, May 28, 2025 at 12:14 PM Kunal Mhaske <kunalmhaske0050(a)gmail.com> > wrote: > >> Vulnerability Name: Clickjacking >> >> Target URL: https://www.ivorysql.org/ >> >> Vulnerability Description : >> >> Clickjacking (User Interface redress attack, UI redress attack, UI >> redressing) is a malicious technique of tricking a Web user into clicking >> on something different from what the user perceives they are clicking on, >> thus potentially revealing confidential information or taking control of >> their computer while clicking on seemingly innocuous web pages. >> >> The server didn't return an X-Frame-Options header which means that this >> website could be at risk of a clickjacking attack. The X-Frame-Options HTTP >> response header can be used to indicate whether or not a browser should be >> allowed to render a page in a <frame> or <iframe>. Sites can use this to >> avoid clickjacking attacks, by ensuring that their content is not embedded >> into other sites. >> >> Typically there is one type of attack - cross-site request forgeries >> (CSRF) that can interact with functions on other websites. >> >> This vulnerability affects the Web Server. >> >> >> <html> >> <head> >> <title>Clickjack test page</title> >> </head> >> <style> >> #myBtn{ >> >> z-index: 999; >> position: absolute; >> top: 100px; >> right: 50px; >> color: white; >> background-color: red; >> } >> </style> >> >> >> >> <body> >>  >> <div style="z-index:-9999; position:absolute;top:0; left:0;width: 70%; >> height:70%"> >> <iframe src="https://www.ivorysql.org/" width="100%" height="100%" > >> >> </iframe></div> >> <div align="right" style="position:absolute; top:1; left:0; z-index:1; >> width: 70%;height:60%; text-align:left;"> >> <a href="https://www.bing.com/"><button id="myBtn"> click >> here</button></a> >> >> <a href="https://www.ivorysql.org/">Open Modal</button></a> >> <div id="myModal" class="modal"> >> >>  >> >> >> </div> >> </body> >> </html> >> >> 2.save it as <anyname>.html eg s.html >> 3. and just simply open that. And click on the button directly >> https://bing.com/ >> As far as I know, this data is enough to prove that your site is >> vulnerable to Clickjacking. >> >> [image: image.png] >> >>

Sept. 16, 2025

Re: Bug Report(DMARC RECORD MISSING)

by Kunal Mhaske

Hello Team, Please give me a response regarding this Bug Report, Please. On Mon, Jun 16, 2025 at 11:20 PM Kunal Mhaske <kunalmhaske0050(a)gmail.com> wrote: > Hello Team, > Please give me a response regarding this Bug Report, Please team. > > > On Wed, May 28, 2025 at 12:12 PM Kunal Mhaske <kunalmhaske0050(a)gmail.com> > wrote: > >> Vulnerability Name: DMARC RECORD MISSING >> >> Target URL: https://ivorysql.org/ >> >> HOW TO REPRODUCE(POC-ATTACHED):- >> >> 1. GO TO- https://mxtoolbox.com/ >> >> 2. ENTER THE WEBSITE(ivorysql.org ) click on MX lookup >> >> 3. YOU WILL SEE THE FAULT(No DMARC Record found). >> >> 4. In the new page that loads, change MXLookup to DMARCLookup. >> >> Extra info >> >> Impact: >> Spammers can forge the "From" address on email messages to make messages >> appear to come from someone in your domain. If spammers use your domain to >> send spam or junk email, your domain quality is negatively affected. People >> who get forged emails can mark them as spam or junk, which can impact >> authentic messages sent from your domain. >> >> [image: image.png] >> >>

Sept. 16, 2025