PHP Self Cross Site Scripting en MantisBT 1.2.x

Resumen

Existen vulnerabilidades de tipo Cross Site Scripting en multiples archivos de MantisBT con versiones 1.2.7, 1.2.6, 1.2.5, 1.2.4, 1.2.3, 1.2.2 y posiblemente otras.

Descripción

Versiones afectadas: 1.2.7, 1.2.6, 1.2.5, 1.2.4, 1.2.3, 1.2.2 y posiblemente otras.

Solución: Actualizar a la version 1.2.8

Websec-id:ws11-16

CVE: CVE-2011-3356

MantisBT

MantisBT is a free popular web-based bugtracking system (feature list). It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver. MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web browser should be able to function as a client. It is released under the terms of the GNU General Public License (GPL).

Detalles

La variable $_SERVER["PHP_SELF"] no es filtrada antes de ser usada y ocasiona vulnerabilidades de tipo Cross Site Scripting en diferentes archivos de la aplicación.

POC

http://host/plugin.php/333%22%20onerror=%22alert%28document.cookie%29%22%20/%3E?page=ManTweet/index.php