MantisBT: Stored XSS in print_all_bug_page_word.php
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert(1).
When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes <img src="..." alt="" onload="alert(1)" />, breaking out of the alt attribute.
Cross-site scripting.
Impact is limited by MantisBT's Content Security Policy.
None
MantisBT thanks the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.
为什么是这个 VPI(可解释·实验性)
VPI 计算依据
| 影响度(严重程度等级估算值) | 80.00 |
| 利用信号(无额外利用信号) | ×1.00 |
| VPI | 80.00 |
VPI 公式 vpi-v1