CVE-2014-9571: XSS in install.php

[Damien Regad <dregad () mantisbt org>]

Greetings,

Please update CVE-2014-9571 with the information below


Description:

Vulnerabilities described in this section can be used by attackers to 
steal cookies of application’s administrator and other website users. 
Attackers can also perform spear phishing attacks against web site 
visitors by replacing original content of the web site with arbitrary 
HTML and script code, perform drive-by-download attacks by injecting 
malware into web pages, and bypass existing CSRF protection mechanism.

The vulnerability exists due to insufficient filtration of input data 
passed via the "admin_username" and "admin_password" HTTP GET parameters 
to "/[admin]/install.php" script. A remote attacker can trick a 
logged-in user to open a specially crafted link and execute arbitrary 
HTML and script code in browser in context of the vulnerable website.

Below are two exploitation examples that use the "alert()" JavaScript 
function to display "immuniweb" word:

http://mantis/[admin]/install.php?install=1&admin_username=1%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://mantis/[admin]/install.php?install=1&admin_password=1%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E

Note, that "[admin]" in the URL is changed by default during MantisBT 
installation. Therefore, the attacker must know the location of the 
administrative interface in order to perform the attack. However, admin 
panel URL can be bruteforced or predicted in many cases.

Affected versions:
- <= 1.2.19
- <= 1.3.0-beta.1

Fixed in versions:
- 1.2.19 (not yet released)
- 1.3.0-beta.2 (not yet released)

Patch:
See Github [1]

Credit:
This vulnerability was reported [2] by High-Tech Bridge Security 
Research Lab (https://www.htbridge.com/), via advisory ID HTB23243 [3].
The issue was fixed by Damien Regad (MantisBT Developer).

References:
Further details available in our issue tracker [4]

[1] http://github.com/mantisbt/mantisbt/commit/6d47c047 (1.2.x)
    http://github.com/mantisbt/mantisbt/commit/132cd6d0 (1.3.x)
[2] https://www.mantisbt.org/bugs/view.php?id=17937
[3] https://www.htbridge.com/advisory/HTB23243
[4] https://www.mantisbt.org/bugs/view.php?id=17938