Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to login_page.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
MantisBT URI重定向漏洞
Vulnerability Description
MantisBT是MantisBT团队的一套基于Web的开源缺陷跟踪系统。该系统以Web操作的形式提供项目管理及缺陷跟踪服务。 MantisBT 1.2.18之前版本的core/string_api.php脚本中存在安全漏洞，该漏洞源于程序运行在Web root下时，没有正确为URL分类。远程攻击者可借助‘return’参数中特制的URL利用该漏洞实施开放重定向攻击和钓鱼攻击。
CVSS Information
N/A
Vulnerability Type
N/A