CVE-2024-34081: Insufficient Information (NVD-CWE-noinfo)
value: MantisBT (Mantis Bug Tracker) is an open source issue tracker.  Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:38Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: bug_change_status_page.php, core/print_api.php
Commit date: 2024-05-12 18:01:00 +0200
Commit message: Proper escaping of Custom Field name for display

Fixes XSS vulnerability on
- bug_change_status_page.php (resolving and closing issues)
- view_all_bug_page.php & print_all_bug_page.php (when the custom field
  is selected as a column for display/print)

Fixes #34432, CVE-2024-34081

Diff: diff --git a/bug_change_status_page.php b/bug_change_status_page.php
index 4278503891e..a771f2d6c3d 100644
--- a/bug_change_status_page.php
+++ b/bug_change_status_page.php
@@ -301,11 +301,11 @@ layout_page_begin();
 		$t_has_write_access = custom_field_has_write_access( $t_id, $f_bug_id );
 ?>
 	<tr>
 		<th class="category">
 			<?php if( $t_require && $t_has_write_access ) {?><span class="required">*</span><?php } ?>
-			<?php echo lang_get_defaulted( $t_def['name'] ) ?>
+			<?php echo string_attribute( lang_get_defaulted( $t_def['name'] ) ) ?>
 		</th>
 		<td>
 <?php
 			if( $t_has_write_access ) {
 				print_custom_field_input( $t_def, $f_bug_id, $t_require );
diff --git a/core/print_api.php b/core/print_api.php
index f5fd68bc27f..cc3dbd230a8 100644
--- a/core/print_api.php
+++ b/core/print_api.php
@@ -1342,11 +1342,16 @@ function print_view_bug_sort_link( $p_string, $p_sort_field, $p_sort, $p_dir, $p
 				$p_dir = 'ASC';
 			}
 			$t_sort_field = rawurlencode( $p_sort_field );
 			$t_print_parameter = ( $p_columns_target == COLUMNS_TARGET_PRINT_PAGE ) ? '&print=1' : '';
 			$t_filter_parameter = filter_is_temporary( $g_filter ) ? filter_get_temporary_key_param( $g_filter ) . '&' : '';
-			print_link( 'view_all_set.php?' . $t_filter_parameter . 'sort_add=' . $t_sort_field . '&dir_add=' . $p_dir . '&type=' . FILTER_ACTION_PARSE_ADD . $t_print_parameter, $p_string );
+			$t_url = 'view_all_set.php?' . $t_filter_parameter
+				. 'sort_add=' . $t_sort_field
+				. '&dir_add=' . $p_dir
+				. '&type=' . FILTER_ACTION_PARSE_ADD
+				. $t_print_parameter;
+			print_link( $t_url, string_attribute( $p_string ) );
 			break;
 		default:
 			echo $p_string;
 	}
 }

Vulnerable code: 			<?php echo lang_get_defaulted( $t_def['name'] ) ?>
			print_link( 'view_all_set.php?' . $t_filter_parameter . 'sort_add=' . $t_sort_field . '&dir_add=' . $p_dir . '&type=' . FILTER_ACTION_PARSE_ADD . $t_print_parameter, $p_string );
Fixed code: 			<?php echo string_attribute( lang_get_defaulted( $t_def['name'] ) ) ?>
			$t_url = 'view_all_set.php?' . $t_filter_parameter
				. 'sort_add=' . $t_sort_field
				. '&dir_add=' . $p_dir
				. '&type=' . FILTER_ACTION_PARSE_ADD
				. $t_print_parameter;
			print_link( $t_url, string_attribute( $p_string ) );