Announcements plugin for MantisBT, lets privileged accounts create and post announcements that can be shown to users on a global or per-project basis, and allow users to dismiss individual messages.
MIT License
20
stars
14
forks
source link
Non authenticated member can post a news to a private project #55
When the admin enable the news section a new stuffs will appear like the main field which will use for announcement/news. Some user can have access on it (manager). However it seems that a lot of security issue introduce here..
Description
This allows the attacker to post announcement on a private project even you are not part of it
Do the same thing but this time edit the project_id to any private project
Send it
The news will send to that private project
Some notes
These are the stuffs that I observe but I am not sure if this is just part of the configuration feature (this can be prevent if the admin just set the configuration to admin..)
Delete news for private project
allows the manager to delete the news/announcement for that private project
View the private project name
allows to disclose the private project name
All these stuffs can be done after going to plugin.php?page=Announce/list I just add this information.... I believe these issues should be consider to fix/update
When the admin enable the news section a new stuffs will appear like the
main
field which will use for announcement/news. Some user can have access on it (manager). However it seems that a lot of security issue introduce here..Description
This allows the attacker to post announcement on a private project even you are not part of it
Steps to produce
Request
Response
1
Manager as attacker
Request
Response
project_id
to any private projectSome notes
These are the stuffs that I observe but I am not sure if this is just part of the
configuration
feature (this can be prevent if the admin just set the configuration to admin..)Delete news for private project
View the private project name
All these stuffs can be done after going to
plugin.php?page=Announce/list
I just add this information.... I believe these issues should be consider to fix/update