|
Description
|
|
Some vulnerabilities have been reported in phpBugTracker, which can be exploited by malicious people to conduct cross-site scripting, cross-site request forgery, and SQL injection attacks.
1) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions if a logged-in administrator visits a malicious web site.
2) Input passed via the "use_js" parameter to admin/user.php and admin/group.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
3) Certain input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
4) Input passed via the "id" parameter to admin/project.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
5) Certain unspecified input is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerabilities #1 through #5 are reported in versions prior to 1.7.0.
6) Certain input passed to templates/default/index.html.php and templates/default/bugdisplay.html.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
This vulnerability is reported in versions prior to 1.7.2.
|
