Vulnerability findings for the public-facing infrastructure of overdrive.co.za

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. The response from the target does not include a Content-Security-Policy header, leaving the browser without an explicit allow-list for sources of executable script, styles, frames, and embeddable objects.

The response does not protect against ClickJacking attacks. It should include either a Content-Security-Policy with a frame-ancestors directive, or an X-Frame-Options header.

The integrity attribute is missing on script and link tags served from external sources. The integrity attribute prevents an attacker who has gained access to a third-party server from injecting malicious content.

HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents must interact with it using only secure HTTPS connections. The response does not include a Strict-Transport-Security header, so a downgrade attack from HTTPS to plaintext HTTP is possible on the first visit.

The __wpdm_client cookie is set without a SameSite attribute, which means the cookie can be sent as a result of a cross-site request. SameSite is an effective counter-measure against CSRF, cross-site script inclusion, and timing attacks.

The page includes script files from a third-party domain. If the third-party origin is compromised, attacker-controlled JavaScript executes in your origin's context.

The Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that do not explicitly grant the document permission via CORP or CORS.

The Cross-Origin-Opener-Policy header allows a site to control whether other documents share the same browsing context. Sharing a browsing context with untrusted documents can lead to data leaks via window references.

Cross-Origin-Resource-Policy is an opt-in header designed to counter side-channel attacks like Spectre. Resources should explicitly state that they may be loaded across origins, otherwise they should be marked as same-origin.

A dangerous JavaScript function (eval) appears to be in use on the page. eval executes a string as code; if any part of the input string is attacker-influenced, this becomes an XSS sink. Often present inside vendor or plugin scripts.

The Permissions Policy header restricts which browser features (camera, microphone, geolocation, etc.) the page is allowed to use. The header is not set, so default permissions apply.

Timestamps were disclosed by the application in plaintext form. Exposed values resolve to dates in 2025-03 and 2026-04, suggesting build/deploy or last-modified markers leaking through cache-busting query strings.

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to nosniff. This allows older browsers to perform MIME-sniffing on the response body, potentially interpreting it as a content type other than the declared one.