CVE-2010-2574

Vulnerability

A cross-site scripting (XSS) vulnerability exists in MantisBT version 1.2.2 in the manage_proj_cat_add.php script. When an authenticated administrator creates a new project category, the name parameter is not properly sanitized before being stored and later displayed. This allows injection of arbitrary HTML and script code [2].

Exploitation

An attacker must have administrator privileges in MantisBT. The attacker crafts a malicious payload in the name parameter when performing an Add Category action. No additional user interaction is required beyond the administrator submitting the form. The injected script is stored and executed when other administrators view the category list [2].

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of other administrators' browsers. This can lead to session hijacking, defacement, or further compromise of the MantisBT instance. The attack is classified as a stored XSS with a severity of "Less critical" [2].

Mitigation

The vulnerability is fixed in MantisBT version 1.2.3, which was released in September 2010 [3][4]. Users should upgrade to 1.2.3 or later. No workarounds are documented in the available references.