View Issue Details

WikiJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0006558mantisbtsecuritypublic2006-01-04 22:432006-10-09 11:55
Reporterthraxisp Assigned Tothraxisp  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Product Versiongit trunk 
Fixed in Version1.1.0a1 
Summary0006558: XSS Vulnerability in manage_user (TKADV2005-11-002)
Description

It is possible to embed an XSS script into the sort field of the manage_user_page. It is then trapped in the use's cookies.

From Thomas Waldegger [thomas.waldegger at morph3us dot org]

You did not address the "MANTIS_MANAGE_COOKIE" cookie bug (XSS,
unexploitable SQL-Injection, temporary defacement), the XSS
vulnerabilities in view_filters_page.php',proj_doc_delete.php',
query_store_page.php',query_store.php' and there are still a lot of
scripts which do not properly validate user-supplied input.

/manage_user_page.php:

?sort=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&save=1

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
child of 0006556 closedthraxisp XSS Vulnerability in manage_user (TKADV2005-11-002) 

Activities

thraxisp

thraxisp

2006-01-04 22:46

reporter   ~0011867

Fixed in CVS.

core/database_api.php -> 1.48
manage_user_page.php -> 1.61