The X-Frame Options is missing on the Zen Cart v1.5.1

Testing Environment:
Operating System: Windows 7 (32-bit)
Browser: Mozilla Firefox v17.0
Firefox Addon: Clickjacking Defense (https://addons.mozilla.org/en-us/fir...efense-declar/)

Impact: Highly Critical

Description of the Issue: As there is no X-Frame Options, the latest stable release of Zen Cart v1.5.1 is vulnerable to UI Redressing(ClickJacking) attack. All the modules of Zen Cart can be opened inside a malicious frame and from the attacker point of view various malicious activity can be carried over a victim end.

Mitigation: An X-Frame Options must be set in the headers as DENY or SAME ORIGIN.

References: https://www.owasp.org/index.php/Clickjacking

Regards,
Himanshu(@mehimansu)