Secunia Research has discovered a vulnerability in MantisBT, which can be exploited by malicious users to conduct script insertion attacks. Input passed via the "name" parameter to manage_proj_cat_add.php when creating a project category is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires "manager" permissions. Version 1.2.2 is affected.
46030b6db921b875dabdcc45a59ef647e23e06d317424a1dae84bda6eecc94b4
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed