This host is installed with MantisBT and is prone to multiple vulnerabilities.

Successful exploitation will allow attackers to execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server, access the installation script and obtain database access credentials and conduct SQL injection attacks. Impact Level: Application

Upgrade to MantisBT version 1.2.19 or 1.3.0-beta.2 or later. For updates refer to http://www.mantisbt.org/download.php

Multiple flaws are due to, - Insufficient filtration of input data passed via the 'admin_username' and 'admin_password' HTTP GET parameters to '/install.php' script. - Insufficient access restrictions to the installation script 'install.php' when HTTP GET 'install' parameter is set to '4'. - Insufficient filtration of the 'MANTIS_MANAGE_USERS_COOKIE' HTTP COOKIE in '/manage_user_page.php' script.

MantisBT version before 1.2.19 and 1.3.x before 1.3.0-beta.2

Get the installed version with the help of detect NVT and check the version is vulnerable or not.

• http://seclists.org/oss-sec/2015/q1/156
• http://seclists.org/oss-sec/2015/q1/157
• http://seclists.org/oss-sec/2015/q1/158
• http://xforce.iss.net/xforce/xfdb/100209
• http://xforce.iss.net/xforce/xfdb/100210
• http://xforce.iss.net/xforce/xfdb/100211
• https://www.htbridge.com/advisory/HTB23243
• https://www.mantisbt.org/bugs/view.php?id=17937

---

Updated on 2015-03-25