CVE-2006-0840: manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a '...

Security readout for executives and security teams

This issue affects very old Mantis installations, described as Mantis 1.00rc4 and earlier. A malformed sort value on the user-management page can cause SQL errors that persist for later users with a management cookie. The sources do not show confirmed active exploitation or a complete severity score. Exposure is likely limited to organizations still running Mantis 1.00rc4 or earlier, especially if management pages are reachable by remote users. Current internet exposure cannot be inferred from the provided sources. Low immediate urgency unless legacy Mantis is still in use. If found on an exposed system, prioritize upgrade planning because the affected software is obsolete and the behavior involves remotely triggered SQL errors. Mitigation focus: Inventory Mantis deployments and identify any 1.00rc4 or earlier instances.; Check Mantis or SourceForge release guidance for a corrected upgrade path.; Restrict remote access to Mantis management pages while remediation is assessed..

Prepared

Jun 29, 2026, 14:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.