MantisBT 2.28.3 and earlier have six reflected XSS injection points in /admin/install.php where user input is echoed without escaping via print_test_result(). The CSP restricts inline scripts but lacks a form-action directive, enabling attackers to craft URLs that render fake login forms for credential phishing, perform open redirects to malicious sites, and manipulate the UI via CSS injection. These vulnerabilities do not require authentication. Official patches are available in the MantisBT GitHub repository. A recommended workaround is to remove the /admin directory as per the Admin Guide.

An attacker can exploit these reflected XSS vulnerabilities to perform credential phishing by displaying fake login forms on the legitimate MantisBT admin page, potentially capturing admin credentials. They can also cause victims to be silently redirected to phishing or malware sites via open redirects. Additionally, UI manipulation through CSS injection can hide legitimate content and overlay attacker-controlled HTML, facilitating social engineering attacks. These impacts can lead to credential compromise and further system compromise.

Official patches addressing these vulnerabilities have been released by the MantisBT project (see referenced GitHub commits). Users should upgrade to versions later than 2.28.3 to remediate the issue. As a workaround, removing the /admin directory is recommended according to the MantisBT Admin Guide. No additional mitigation is required if the patch is applied or the workaround is implemented.