CVE-2017-7897 in MantisBT
Summary
by MITRE
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted URL parameter, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/05/2025
The CVE-2017-7897 vulnerability represents a critical cross-site scripting flaw in MantisBT version 2.3.x before 2.3.2 that specifically targets the Timeline include page functionality. This vulnerability exists within the web application's user interface components, particularly affecting the My View page and User Information page where the vulnerable code executes. The flaw stems from improper input validation and sanitization practices within the application's URL handling mechanisms, creating a pathway for malicious actors to execute arbitrary code in the context of authenticated users' browsers. The vulnerability demonstrates a classic weakness in web application security where server-side variables are directly incorporated into client-side output without adequate sanitization.
The technical root cause of this vulnerability lies in the application's reliance on the unsanitized $_SERVER['PHP_SELF'] variable when constructing URLs for the Timeline include page functionality. This server variable contains the filename of the current script and potentially user-supplied data from the HTTP request, making it susceptible to manipulation by attackers. When the application processes URLs through the my_view_page.php and view_user_page.php scripts, it fails to properly sanitize or validate the PHP_SELF variable before incorporating it into generated hyperlinks. The vulnerability specifically affects the Timeline feature that displays user activity and project progress, making it particularly dangerous as it can be exploited during normal user operations. This flaw aligns with CWE-79, which describes cross-site scripting vulnerabilities resulting from improper sanitization of user-controllable input data.
The operational impact of this vulnerability extends beyond simple code injection, as it can enable attackers to perform a wide range of malicious activities within the context of authenticated users. Remote attackers can leverage this vulnerability to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or redirection to malicious sites. The vulnerability's exploitation becomes more severe when Content Security Policy (CSP) settings are permissive, allowing the injected scripts to execute without additional restrictions. Attackers can craft malicious URLs that, when visited by authenticated users, trigger the XSS payload and compromise the user's session or the application's integrity. This vulnerability particularly affects organizations using MantisBT for project management and issue tracking, where users may have elevated privileges and access to sensitive project information.
Organizations affected by CVE-2017-7897 should implement immediate mitigations including upgrading to MantisBT version 2.3.2 or later, which contains the necessary patches to address the XSS vulnerability. The fix involves proper sanitization of the $_SERVER['PHP_SELF'] variable before using it in URL generation, ensuring that any potentially malicious input is neutralized or removed. Security teams should also implement additional defensive measures such as strict Content Security Policy headers that limit script execution, input validation for URL parameters, and monitoring for suspicious URL patterns. The vulnerability's exploitation requires minimal effort from attackers, making it particularly dangerous in environments where users frequently interact with web applications containing vulnerable code paths. Organizations should conduct thorough security assessments of their web applications and implement automated scanning tools to identify similar vulnerabilities in other components of their software infrastructure. This vulnerability exemplifies the importance of proper input validation and output encoding practices in preventing XSS attacks, aligning with ATT&CK technique T1059.007 for script injection and T1566 for credential access through web application vulnerabilities.