CVE-2006-0841
Mantis <= 1.00rc4 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-0841. PoCs published by Thomas Waldegger.
AI-analyzed exploit summary The provided text describes multiple input-validation vulnerabilities in Mantis, including XSS and SQL injection. It lists various URLs with parameters susceptible to XSS attacks but does not include executable exploit code.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8) show_status, (9) show_resolution, (10) show_build, (11) show_profile, (12) show_priority, (13) highlight_changed, (14) relationship_type, and (15) relationship_bug parameters in (a) view_all_set.php; the (16) sort parameter in (b) manage_user_page.php; the (17) view_type parameter in (c) view_filters_page.php; and the (18) title parameter in (d) proj_doc_delete.php. NOTE: item 17 might be subsumed by CVE-2005-4522.
Exploits (2)
The provided text describes multiple input-validation vulnerabilities in Mantis, including XSS and SQL injection. It lists various URLs with parameters susceptible to XSS attacks but does not include executable exploit code.
The provided text describes multiple input-validation vulnerabilities in Mantis, including XSS and SQL injection, but does not contain actual exploit code. It references a URL parameter vulnerable to XSS.