Vulnerability: Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option, a different vulnerability than CVE-2014-8987.
Vulnerability ID: CVE-2014-8986
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2014-11-24
File: adm_config_report.php
Commit message: Fix: adm_config_report.php filtering does not check config option is valid

I've left this throwing ERROR_GENERIC as the only time this should be able
to be hit is if we have invalid input to start with.
Commit author: Paul Richards

Vulnerable version (before fix):
 function print_option_list_from_array( array $p_array, $p_filter_value ) { } else { 	# Retrieve the filter from the cookie if it exists 	$t_cookie_string = gpc_get_cookie( $t_cookie_name, null ); 	if( null !== $t_cookie_string ) { 		$t_cookie_contents = explode( ':', $t_cookie_string );  function print_option_list_from_array( array $p_array, $p_filter_value ) { 	} }  # Get config edit values $t_edit_user_id         = gpc_get_int( 'user_id', $t_filter_user_value == META_FILTER_NONE ? ALL_USERS : $t_filter_user_value ); $t_edit_project_id      = gpc_get_int( 'project_id', $t_filter_project_value == META_FILTER_NONE ? ALL_PROJECTS : $t_filter_project_value );

Fixed version (after fix):
 function print_option_list_from_array( array $p_array, $p_filter_value ) { } else { 	# Retrieve the filter from the cookie if it exists 	$t_cookie_string = gpc_get_cookie( $t_cookie_name, null );  	if( null !== $t_cookie_string ) { 		$t_cookie_contents = explode( ':', $t_cookie_string );  function print_option_list_from_array( array $p_array, $p_filter_value ) { 	} }  if( !is_blank( $t_filter_config_value ) && (int)$t_filter_config_value !== META_FILTER_NONE ) { 	// check that config value exists 	if( @config_get_global( $t_filter_config_value ) === null ) { 		$t_cookie_path = config_get( 'cookie_path' ); 		gpc_clear_cookie( $t_cookie_name, $t_cookie_path );  		trigger_error( ERROR_GENERIC, ERROR ); 	} }  # Get config edit values $t_edit_user_id         = gpc_get_int( 'user_id', $t_filter_user_value == META_FILTER_NONE ? ALL_USERS : $t_filter_user_value ); $t_edit_project_id      = gpc_get_int( 'project_id', $t_filter_project_value == META_FILTER_NONE ? ALL_PROJECTS : $t_filter_project_value );

Patch:
patch: @@ -182,6 +182,7 @@ function print_option_list_from_array( array $p_array, $p_filter_value ) {
 } else {
 	# Retrieve the filter from the cookie if it exists
 	$t_cookie_string = gpc_get_cookie( $t_cookie_name, null );
+
 	if( null !== $t_cookie_string ) {
 		$t_cookie_contents = explode( ':', $t_cookie_string );
 
@@ -195,6 +196,16 @@ function print_option_list_from_array( array $p_array, $p_filter_value ) {
 	}
 }
 
+if( !is_blank( $t_filter_config_value ) && (int)$t_filter_config_value !== META_FILTER_NONE ) {
+	// check that config value exists
+	if( @config_get_global( $t_filter_config_value ) === null ) {
+		$t_cookie_path = config_get( 'cookie_path' );
+		gpc_clear_cookie( $t_cookie_name, $t_cookie_path );
+
+		trigger_error( ERROR_GENERIC, ERROR );
+	}
+}
+
 # Get config edit values
 $t_edit_user_id         = gpc_get_int( 'user_id', $t_filter_user_value == META_FILTER_NONE ? ALL_USERS : $t_filter_user_value );
 $t_edit_project_id      = gpc_get_int( 'project_id', $t_filter_project_value == META_FILTER_NONE ? ALL_PROJECTS : $t_filter_project_value );
path: adm_config_report.php