Mailing List Archive

On Sep 27, 2005, at 7:44, Joxean Koret wrote:

> Hi!
>
> I write a plugin for the latest Mantis Bugtracker
> vulnerabilities. Attached goes the NASL plugin.

This is redundant with plugin #19473 which has been written by David
Maciejak.

In addition to this, your plugin is vulnerable to numerous cross site
scripting issues, at it simply looks for text to be echoed back by
the remote server. Whether Mantis is vulnerable or not, and wether
the remote host is running Mantis or not, you'd get false positives
(ie: try it against www.slashdot.org).


-- Renaud