Description

Clickjacking is a portmanteau of two words ‘click’ and ‘hijacking’. It refers to hijacking user’s click for malicious intent. In it, an attacker embeds the vulnerable site in an transparent iframe in attacker’s own website and overlays it with objects such as button using CSS skills. This tricks users to perform unintended actions on vulnerable website, thinking they are doing those on attacker’s website. Clickjacking, also known as a “UI redress attack”.

Proof of Concept

1. Go to this URL: http://web.clickjacker.io/test?url=http:%2F%2Fdemo.openemr.io%2Fopenemr%2Finterface%2Flogin%2Flogin.php%3Fsite%3Ddefault
2. Observe that the website is getting embeded in an Iframe.
3. Observe that the headers x-frame-options and content-security-policy frame ancestors are missing.