ClickJacking protection can be bypassed.
phpMyAdmin has a number of mechanisms to avoid a clickjacking attack, however these mechanisms either work only in modern browser versions, or can be bypassed.
We consider this vulnerability serious.
Versions 3.5.x and 4.0.x (prior to 4.0.5) are affected.
Thanks to Emanuel Bronshtein for reporting this issue. For more details, please refer to this report.
Assigned CVE ids: CVE-2013-5029
The following commits have been made to fix this issue:
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.