FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mantis -- "view_filters_page.php" cross-site scripting vulnerability

Affected packages
mantis < 1.0.0rc4

Details

VuXML ID 6e3b12e2-6ce3-11da-b90c-000e0c2e438a
Discovery 2005-12-13
Entry 2005-12-14

r0t reports:

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to "target_field" parameter in "view_filters_page.php" isn't properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

References

Bugtraq ID 15842
URL http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html