BID:15842

Mantis View_filters_page.PHP Cross-Site Scripting Vulnerability

Info

Mantis View_filters_page.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	15842
Class:	Input Validation Error
CVE:	CVE-2005-4238
Remote:	Yes
Local:	No
Published:	Dec 13 2005 12:00AM
Updated:	Jun 27 2006 03:40AM
Credit:	r0t is credited with the discovery of this vulnerability.
Vulnerable:	Mantis Mantis 1.0 .0RC3 Mantis Mantis 1.0 .0rc2 Mantis Mantis 1.0 .0rc1 Mantis Mantis 1.0 .0a3 Mantis Mantis 1.0 .0a2 Mantis Mantis 1.0 .0a1 Mantis Mantis 0.19.3 Mantis Mantis 0.19.2 Mantis Mantis 0.19.1 Mantis Mantis 0.19 .0RC1 Mantis Mantis 0.19 .0a2 Mantis Mantis 0.19 .0a1 Mantis Mantis 0.19 .0a Mantis Mantis 0.19 .0 Mantis Mantis 0.18.3 Mantis Mantis 0.18.2 Mantis Mantis 0.18 a1 Mantis Mantis 0.18 0rc1 Mantis Mantis 0.18 0a4 Mantis Mantis 0.18 0a3 Mantis Mantis 0.18 0a2 Mantis Mantis 0.18 Mantis Mantis 0.17.5 Mantis Mantis 0.17.5 Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 Mantis Mantis 0.17.4 Mantis Mantis 0.17.3 Mantis Mantis 0.17.3 Mantis Mantis 0.17.2 Mantis Mantis 0.17.2 Mantis Mantis 0.17.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 Mantis Mantis 0.17.1 Mantis Mantis 0.17 .0 Mantis Mantis 0.17 Mantis Mantis 0.16.1 Mantis Mantis 0.16.1 Mantis Mantis 0.16 .0 Mantis Mantis 0.16 Mantis Mantis 0.15.12 Mantis Mantis 0.15.12 Mantis Mantis 0.15.11 Mantis Mantis 0.15.11 Mantis Mantis 0.15.10 Mantis Mantis 0.15.9 Mantis Mantis 0.15.9 Mantis Mantis 0.15.8 Mantis Mantis 0.15.8 Mantis Mantis 0.15.7 Mantis Mantis 0.15.7 Mantis Mantis 0.15.6 Mantis Mantis 0.15.6 Mantis Mantis 0.15.5 Mantis Mantis 0.15.5 Mantis Mantis 0.15.4 Mantis Mantis 0.15.4 Mantis Mantis 0.15.3 Mantis Mantis 0.15.3 Mantis Mantis 0.15.2 Mantis Mantis 0.15.1 Mantis Mantis 0.15 Mantis Mantis 0.14.8 Mantis Mantis 0.14.7 Mantis Mantis 0.14.6 Mantis Mantis 0.14.5 Mantis Mantis 0.14.4 Mantis Mantis 0.14.3 Mantis Mantis 0.14.2 Mantis Mantis 0.14.1 Mantis Mantis 0.14 Mantis Mantis 0.13.1 Mantis Mantis 0.13 Mantis Mantis 0.12 Mantis Mantis 0.11.1 Mantis Mantis 0.11 Mantis Mantis 0.10.2 Mantis Mantis 0.10.1 Mantis Mantis 0.10 Mantis Mantis 0.9.1 Mantis Mantis 0.9 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1

Not Vulnerable:	Mantis Mantis 1.0 .0RC4 Mantis Mantis 0.19.4

Discussion

Mantis View_filters_page.PHP Cross-Site Scripting Vulnerability

Mantis is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Exploit / POC

Mantis View_filters_page.PHP Cross-Site Scripting Vulnerability

No exploit is required.

An example URI has been provided:

http://www.example.com/view_filters_page.php?for_screen=1&target_field=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E

Solution / Fix

Mantis View_filters_page.PHP Cross-Site Scripting Vulnerability

Solution:
Debian GNU/Linux has released advisory DSA 944-1 along with fixes to address various issues in Mambo. Please see the referenced advisory for more information.

The vendor has released updates addressing this issue.

Mantis Mantis 0.10