Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link.

Secunia reports :

Some vulnerabilities have been reported in Mantis, which can be exploited by malicious users to compromise a vulnerable system and malicious people to conduct cross-site scripting and request forgery attacks.

Input passed to the 'filter_target' parameter in return_dynamic_filters.php is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

A vulnerability is caused due to the application allowing users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g.
add a new user with administrative privileges by enticing a logged-in administrator to visit a malicious site.

Input passed to the 'value' parameter in adm_config_set.php is not properly sanitised before being used in an 'eval()' statement. This can be exploited to e.g. execute arbitrary PHP commands via a specially crafted request.

Input passed to the 'language' parameter in account_prefs_update.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

The remote host is affected by the vulnerability described in GLSA-200809-10 (Mantis: Multiple vulnerabilities)

    Antonio Parata and Francesco Ongaro reported a Cross-Site Request     Forgery vulnerability in manage_user_create.php (CVE-2008-2276), a     Cross-Site Scripting vulnerability in return_dynamic_filters.php     (CVE-2008-3331), and an insufficient input validation in     adm_config_set.php (CVE-2008-3332). A directory traversal vulnerability     in core/lang_api.php (CVE-2008-3333) has also been reported.
  Impact :

    A remote attacker could exploit these vulnerabilities to execute     arbitrary HTML and script code, create arbitrary users with     administrative privileges, execute arbitrary PHP commands, and include     arbitrary files.
  Workaround :

    There is no known workaround at this time.

Update to upstream version 1.1.2, fixing following security issues: - 0008974: XSS Vulnerability in filters - 0008975: CSRF Vulnerabilities in user_create (CVE-2008-2276) - 0008976: Remote Code Execution in adm_config - 0009154: arbitrary file inclusion through user preferences page See upstream changelog for details on all bugs fixed in new upstream version:
http://www.mantisbt.org/bugs/changelog_page.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mantis Bug Tracker installed on the remote host does not verify the validity of HTTP requests before performing various administrative actions.  If a remote attacker can trick a logged-in administrator into viewing a specially crafted page, the vulnerability could be leveraged to launch cross-site request forgery attacks against the affected application, such as creating additional users with administrator privileges. 

Note that the application is also reportedly affected by other issues, including one that allows remote code execution provided an attacker has administrator privileges, although Nessus did not explicitly test for them.

The version of Mantis Bug Tracker installed on the remote host does not verify the validity of HTTP requests before performing various administrative actions.  If a remote attacker can trick a logged-in administrator into viewing a specially-crafted page, he can leverage this issue to launch cross-site request forgery attacks against the affected application, such as creating additional users with administrator privileges.

ID	Name	Product	Family	Severity
35052	FreeBSD : mantis -- multiple vulnerabilities (29255141-c3df-11dd-a721-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
34250	GLSA-200809-10 : Mantis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
33555	Fedora 8 : mantis-1.1.2-1.fc8 (2008-6657)	Nessus	Fedora Local Security Checks	medium
33554	Fedora 9 : mantis-1.1.2-1.fc9 (2008-6647)	Nessus	Fedora Local Security Checks	medium
32324	Mantis manage_user_create.php CSRF New User Creation	Nessus	CGI abuses	medium
4506	Mantis Cross-Site Request Forgery Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2008-2276

high

Tenable Plugins

high

high

medium

medium

medium

medium