https://www.exploit-db.com/exploits/26172
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200509-277

Mantis是一个基于PHP技术的轻量级的开源缺陷跟踪系统，其功能与JIRA系统类似，都是以Web操作的形式提供项目管理及缺陷跟踪服务。在功能上可能没有JIRA那么专业，界面也没有JIRA漂亮，但在实用性上足以满足中小型项目的管理及跟踪。Mantis0.19.0a1至1.0.0a3版本中的view_all_set.php脚本中存在跨站脚本攻击(XSS)漏洞，远程攻击者可通过dir参数注入任意web脚本或HTML，dir参数由#0005959bug识别。

source: http://www.securityfocus.com/bid/14604/info

Mantis is prone to multiple input validation vulnerabilities. These issues involve cross-site scripting, HTML injection and variable poisoning, and are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Successful exploitation of the HTML injection issue could result in having attacker-supplied HTML and script code executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

The variable poisoning issue could result in unauthorized access and denial of service attacks. 

A - Cross Site Scripting Vulnerabilities

http://www.example.com/view_all_set.php?sort=severity&dir="><script>alert(document.cookie)</script>&type=2

B.- Database scanner via variable poisoning

http://www.example.com/core/database_api.php?g_db_type=mysql://invaliduser@localhost:3336
http://www.example.com/core/database_api.php?g_db_type=mysql://root@localhost:3336
http://www.example.com/core/database_api.php?g_db_type=informix://localhost:8080
http://www.example.com/core/database_api.php?g_db_type=mysql://[email protected]

来源:XF
名称:mantis-bug-report-xss(21958)
链接:http://xforce.iss.net/xforce/xfdb/21958
来源:BID
名称:14604
链接:http://www.securityfocus.com/bid/14604
来源:GENTOO
名称:GLSA-200509-16
链接:http://www.gentoo.org/security/en/glsa/glsa-200509-16.xml
来源:DEBIAN
名称:DSA-778
链接:http://www.debian.org/security/2005/dsa-778
来源:www.mantisbt.org
链接:http://www.mantisbt.org/changelog.php
来源:SECUNIA
名称:16506
链接:http://secunia.com/advisories/16506
来源:BUGTRAQ
名称:20050926MantisBugtracker-RemoteDatabaseScannerandXSSVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112786017426276&w;=2