MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required.
A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.
Impact
Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.
Open redirect: Victim is silently redirected to a phishing or malware site.
UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering.