core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type variable and monitoring the speed of responses, as identified by bug#0005956.

The remote host is affected by the vulnerability described in GLSA-200509-16 (Mantis: XSS and SQL injection vulnerabilities)

    Mantis fails to properly sanitize untrusted input before using it.
    This leads to a SQL injection and several cross-site scripting     vulnerabilities.
  Impact :

    An attacker could possibly use the SQL injection vulnerability to     access or modify information from the Mantis database. Furthermore the     cross-site scripting issues give an attacker the ability to inject and     execute malicious script code or to steal cookie-based authentication     credentials, potentially compromising the victim's browser.
  Workaround :

    There is no known workaround at this time.

Two security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2556     A remote attacker could supply a specially crafted URL     to scan arbitrary ports on arbitrary hosts that may not     be accessible otherwise.

  - CAN-2005-2557

    A remote attacker was able to insert arbitrary HTML code     in bug reports, hence, cross site scripting.

  - CAN-2005-3090

    A remote attacker was able to insert arbitrary HTML code     in bug reports, hence, cross site scripting.

The old stable distribution (woody) does not seem to be affected by these problems.

According to its banner, the version of Mantis on the remote host fails to sanitize user-supplied input to the 'g_db_type' parameter of the 'core/database_api.php' script.  Provided PHP's 'register_globals' setting is enabled, an attacker may be able to exploit this to connect to arbitrary databases as well as scan for arbitrary open ports, even on an internal network.  In addition, it is reportedly prone to multiple cross-site scripting issues.

The remote host seems to be running a vulnerable version of Mantis, a bug tracker web application written in PHP. It is reported that versions up to 0.19.3 are prone to multiple HTML and SQL injection flaws that would allow an attacker to upload or execute arbitrary code as well as manipulate database data.

ID	Name	Product	Family	Severity
19815	GLSA-200509-16 : Mantis: XSS and SQL injection vulnerabilities	Nessus	Gentoo Local Security Checks	high
19475	Debian DSA-778-1 : mantis - missing input sanitising	Nessus	Debian Local Security Checks	high
19473	Mantis < 1.0.0rc2 Multiple Vulnerabilities	Nessus	CGI abuses	medium
3173	Mantis < 0.19.3 Multiple Injection Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-2556

high

Tenable Plugins

high

high

medium

high