CVE:CVE-2006-0840
CNNVD:CNNVD-200602-337
Mantis 1.00rc4及之前版本的manage_user_page.php没有正确处理包含'(引用)字符的sort参数，从而可使远程攻击者触发SQL错误，系统会反复向使用MANTIS_MANAGE_COOKIE cookie进行后续web访问的用户报告这个错误。
solution:Upgrade mantis mantis to a higher version than 1.0.0_rc4,0.9,0.9.0,0.9.1,0.10,0.10.0,0.10.1,0.10.2,0.11,0.11.0,0.11.1,0.12,0.12.0,0.13,0.13.0,0.13.1,0.14,0.14.0,0.14.1,0.14.2,0.14.3,0.14.4,0.14.5,0.14.6,0.14.7,0.14.8,0.15,0.15.0,0.15.1,0.15.2,0.16,0.16.0,0.17,0.17.0,0.17.4a,0.18,0.18.0,0.18.0_rc1,0.18.0a1,0.18.0a2,0.18.0a3,0.18.0a4,0.18.1,0.18.2,0.18.3,0.18a1,0.19.0,0.19.0_rc1,0.19.0a,0.19.0a1,0.19.0a2,0.19.1,0.19.2,0.19.3,0.19.4,1.0.0_rc1,1.0.0_rc2,1.0.0_rc3,1.0.0a1,1.0.0a2,1.0.0a3,and avoid the version (,1.0.0_rc4],0.9,0.9.0,0.9.1,0.10,0.10.0,0.10.1,0.10.2,0.11,0.11.0,0.11.1,0.12,0.12.0,0.13,0.13.0,0.13.1,0.14,0.14.0,0.14.1,0.14.2,0.14.3,0.14.4,0.14.5,0.14.6,0.14.7,0.14.8,0.15,0.15.0,0.15.1,0.15.2,0.16,0.16.0,0.17,0.17.0,0.17.4a,0.18,0.18.0,0.18.0_rc1,0.18.0a1,0.18.0a2,0.18.0a3,0.18.0a4,0.18.1,0.18.2,0.18.3,0.18a1,0.19.0,0.19.0_rc1,0.19.0a,0.19.0a1,0.19.0a2,0.19.1,0.19.2,0.19.3,0.19.4,1.0.0_rc1,1.0.0_rc2,1.0.0_rc3,1.0.0a1,1.0.0a2,1.0.0a3