CVE-2020-25830: 
PHP vulnerability analysis and mitigation

An HTML injection vulnerability (CVE-2020-25830) was discovered in MantisBT before version 2.24.3. The vulnerability stems from improper escaping of custom field names in the bug_actiongroup_page.php file, which allows attackers to inject HTML content into the page (NVD).

The vulnerability exists in the bug_actiongroup_page.php file where custom field names are not properly sanitized before being displayed. When processing custom fields, the application failed to properly escape the field names using the string_attribute function, allowing for HTML injection. The issue was fixed by adding proper string escaping to the custom field name output (MantisBT Commit).

The vulnerability allows attackers to inject arbitrary HTML content into the page through crafted custom field names. This could potentially lead to Cross-Site Scripting (XSS) attacks when users view affected pages (MantisBT Issue).

The vulnerability can be exploited by an attacker with administrative access to create a custom field with a maliciously crafted name. When users view the bug action group page containing this custom field, the injected HTML content would be rendered in their browser (MantisBT Issue).

The vulnerability was fixed in MantisBT version 2.24.3. The fix involves properly escaping custom field names using the string_attribute function before displaying them in the bug_actiongroup_page.php file. Users should upgrade to version 2.24.3 or later to address this vulnerability (MantisBT Commit).