p PatchFirst

CVE-2026-52847

CVE-2026-52847 · MantisBT: Reflected XSS in admin/install.php

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required. A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects. ### Impact - Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server. - Open redirect: Victim is silently redirected to a phishing or malware site. - UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering. ### Patches - https://github.com/mantisbt/mantisbt/commit/0f32ceabadc745239754962df91a51d5d51e3fd7 - https://github.com/mantisbt/mantisbt/commit/f2191a0d8ce438bf74171d496cf721dae025a5c0 ### Workarounds Remove the `/admin` directory, as [recommended in the Admin Guide](https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.install.postcommon) ### Resources - https://mantisbt.org/bugs/view.php?id=37103 - related advisory [GHSA-vcrw-4xvv-jh49](https://github.com/mantisbt/mantisbt/security/advisories/GHSA-vcrw-4xvv-jh49) ### Credits McCaulay Hudson (@_McCaulay) of watchTowr

CVSS 9.2 · Critique · Correctif disponible

Publication
Mise à jour

Pile logicielle: php

Produits et versions concernés

  • mantisbt/mantisbt Packagist

    Versions du logiciel
    • 2.10.0
    • 2.10.1
    • 2.11.0
    • 2.11.1
    • 2.12.0
    • 2.12.1
    • 2.12.2
    • 2.13.0
    • 2.13.1
    • 2.13.2
    • 2.14.0
    • 2.15.0
    • 2.15.1
    • 2.16.0
    • 2.16.1
    • 2.17.0
    • 2.17.1
    • 2.17.2
    • 2.18.0
    • 2.18.1
    • 2.19.0
    • 2.19.1
    • 2.20.0
    • 2.20.1
    • 2.21.0
    • 2.21.1
    • 2.21.2
    • 2.21.3
    • 2.22.0
    • 2.22.1
    • 2.22.2
    • 2.23.0
    • 2.23.1
    • 2.24.0
    • 2.24.1
    • 2.24.2
    • 2.24.3
    • 2.24.4
    • 2.24.5
    • 2.25.0
    • 2.25.1
    • 2.25.2
    • 2.25.3
    • 2.25.4
    • 2.25.5
    • 2.25.6
    • 2.25.7
    • 2.25.8
    • 2.26.0
    • 2.26.1
    • 2.26.2
    • 2.26.3
    • 2.26.4
    • 2.27.0
    • 2.27.1
    • 2.27.2
    • 2.27.3
    • 2.28.0
    • 2.28.1
    • 2.28.2
    • 2.28.3
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.6.0
    • 2.7.0
    • 2.7.1
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 2.9.1
    Plages de versions concernées
    • ECOSYSTEM: < 2.28.4

    Mettez à jour vers 2.28.4

Sources originales

Vérifiez votre serveur →