Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
MantisBT URI重定向漏洞
Vulnerability Description
MantisBT是MantisBT团队的一套基于Web的开源缺陷跟踪系统。该系统以Web操作的形式提供项目管理及缺陷跟踪服务。 MantisBT 1.2.0a3版本至1.2.18版本的core/string_api.php脚本中的‘string_sanitize_url’函数中存在安全漏洞，该漏洞源于程序使用不正确的正则表达式。远程攻击者可借助带有‘:/’符号分隔符的URL利用该漏洞实施开放重定向攻击和钓鱼攻击。
CVSS Information
N/A
Vulnerability Type
N/A