From bba27a3830cd8cd057c6145dc79eddac0490beb2 Mon Sep 17 00:00:00 2001 From: jlatour Date: Wed, 21 Aug 2002 16:39:48 +0000 Subject: [PATCH] Updated title of 'Detailed explanation' in advisories, as it caused confusion. git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@1279 f5dc347c-c33d-0410-90a0-b07cc1902cb9 --- advisories/2002/2002-01.txt | 4 ++-- advisories/2002/2002-02.txt | 4 ++-- advisories/2002/2002-03.txt | 2 +- advisories/2002/2002-04.txt | 4 ++-- advisories/2002/2002-05.txt | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/advisories/2002/2002-01.txt b/advisories/2002/2002-01.txt index 16e0608..862f9a5 100644 --- a/advisories/2002/2002-01.txt +++ b/advisories/2002/2002-01.txt @@ -6,7 +6,7 @@ 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution - 5. Detailed explanation + 5. Proof of Vulnerability 6. Contact details 1. Introduction @@ -80,7 +80,7 @@ patched to secure the exploitable query: Enabling magic_quotes_gpc in your PHP configuration will also prevent the problem from being exploitable. - 5. Detailed explanation + 5. Proof of Vulnerability By modifying the username or the email of a Mantis account, it is possible to change any column of the Mantis user table (mantis_user_table by diff --git a/advisories/2002/2002-02.txt b/advisories/2002/2002-02.txt index 34e49fa..073cf56 100644 --- a/advisories/2002/2002-02.txt +++ b/advisories/2002/2002-02.txt @@ -6,7 +6,7 @@ 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution - 5. Detailed explanation + 5. Proof of Vulnerability 6. Contact details 1. Introduction @@ -65,7 +65,7 @@ earlier versions: $f_user_id = get_current_user_field( "id" ); } - 5. Detailed explanation + 5. Proof of Vulnerability No trickery is required to allow a reporter to see the summaries of bugs that (s)he did not report. The reporter just has to go to 'View Bugs', click diff --git a/advisories/2002/2002-03.txt b/advisories/2002/2002-03.txt index 49e91a8..dcfd3ac 100644 --- a/advisories/2002/2002-03.txt +++ b/advisories/2002/2002-03.txt @@ -98,7 +98,7 @@ the appropriate checks. } # end project selection - 5. Detailed explanation + 5. Proof of Vulnerability To take advantage of this vulnerability, the attacker would need to know the project_id of the private project he wishes to attack. This is not terribly diff --git a/advisories/2002/2002-04.txt b/advisories/2002/2002-04.txt index 223c161..f30fa8c 100644 --- a/advisories/2002/2002-04.txt +++ b/advisories/2002/2002-04.txt @@ -6,7 +6,7 @@ 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution - 5. Detailed explanation + 5. Proof of Vulnerability 6. Credit 7. Contact details @@ -71,7 +71,7 @@ the following lines at the top of summary_graph_functions.php: exit; } - 5. Detailed explanation + 5. Proof of Vulnerability To exploit this vulnerability, an attacker only has to store the PHP code (s)he wishes to execute in a textfile, make this available on a webserver diff --git a/advisories/2002/2002-05.txt b/advisories/2002/2002-05.txt index b3d8bbc..5165116 100644 --- a/advisories/2002/2002-05.txt +++ b/advisories/2002/2002-05.txt @@ -7,7 +7,7 @@ vulnerability in Mantis 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution - 5. Detailed explanation + 5. Proof of Vulnerability 5.1 Arbitrary code execution 5.2 Displaying local files 6. Credit @@ -94,7 +94,7 @@ the following lines in core_API.php: exit; } - 5. Detailed explanation + 5. Proof of Vulnerability 5.1 Arbitrary code execution