CVE-2005-4522

An anonymous remote attacker can craft a malicious link containing XSS payloads in the `view_type` or `target_field` GET parameters of `view_filters_page.php` [ref_id=1]. When a victim clicks the link, the unsanitized input is rendered in the browser, allowing arbitrary HTML or JavaScript execution in the victim's session context [ref_id=1]. The advisory classifies both as non-persistent (reflected) XSS and notes they are exploitable regardless of whether `magic_quotes_gpc` is enabled [ref_id=1].

The vulnerability resides in `view_filters_page.php`, specifically in the handling of the `view_type` and `target_field` GET parameters [ref_id=1]. The advisory identifies these two parameters as lacking proper sanitization before being reflected in the page output [ref_id=1].

The advisory does not include a patch diff, but directs users to upgrade to Mantis 0.19.4 / 1.0.0rc4 or newer [ref_id=1]. The fix presumably adds proper input sanitization or output encoding for the `view_type` and `target_field` parameters in `view_filters_page.php` to prevent reflected XSS [ref_id=1].

1. Host a Mantis instance version 0.19.3 or earlier (or 1.0.0rc3 and earlier). 2. As an unauthenticated attacker, craft a URL: `[path_to_mantis]/view_filters_page.php?target_field=reporter_id[]&view_type=">` 3. Send the crafted URL to a victim. 4. When the victim visits the URL, the injected `">` sequence is rendered in the page, demonstrating reflected XSS [ref_id=1].