From Tobias Klein (tk at trapkit.de)

[1] SQL Injection

Possible damage: Critical
Probability of occurrence: High
Resulting threat: Critical

HTTP method: GET

Vulnerability description:

Mantis is prone to a SQL injection vulnerability. This issue is
due to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

Vulnerable URL:

[path_to_mantis]/view_all_set.php?sort=

Proof of Concept:

[path_to_mantis]/view_all_set.php?sort=priority'

plus

I came across several security related problems in the latest version of
Mantis after a quick review of the code. Maybe I'll take a further look
at the code the next days.

/view_all_set.php:
GET: ?type=1&handler_id=1&hide_status=[XSS]
GET: ?type=1&handler_id=[XSS]
GET: ?type=1&temporary=y&user_monitor=[XSS]
GET: ?type=1&temporary=y&reporter_id=[XSS]
GET: ?type=6&view_type=[XSS]
GET: ?type=1&show_severity=[XSS]
GET: ?type=1&show_category=[XSS]
GET: ?type=1&show_status=[XSS]

GET: ?type=1&show_resolution=[XSS]
GET: ?type=1&show_build=[XSS]
GET: ?type=1&show_profile=[XSS]
GET: ?type=1&show_priority=[XSS]

GET: ?type=1&highlight_changed=[XSS]
GET: ?type=1&relationship_type=[XSS]
GET: ?type=1&relationship_bug=[XSS]