CVE-2008-4687 manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the...
HighCVSS 9.0
EPSS 67.5%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mantis | <= 1.1.3 | No fix listed |
| mantis | = 0.19.3 | No fix listed |
| mantis | = 0.19.4 | No fix listed |
| mantis | = 1.0.1 | No fix listed |
| mantis | = 1.0.2 | No fix listed |
| mantis | = 1.0.3 | No fix listed |
| mantis | = 1.0.4 | No fix listed |
| mantis | = 1.0.5 | No fix listed |
| mantis | = 1.0.6 | No fix listed |
| mantis | = 1.0.7 | No fix listed |
| mantis | = 1.0.8 | No fix listed |
| mantis | = 1.1.1 | No fix listed |
| mantis | = 1.1.2 | No fix listed |
References
- mantisbt.svn.sourceforge.net
- 32314 third-party-advisory vendor-advisory
- 32975 third-party-advisory
- 4470 third-party-advisory
- GLSA-200812-07 vendor-advisory
- www.mantisbt.org
- www.mantisbt.org
- [oss-security] 20081019 CVE request: mantisbt < 1.1.4: RCE mailing-list
- 31789 vdb-entry
- bugs.gentoo.org
- mantis-sort-code-execution(45942) vdb-entry
- 44611 exploit
- 6768 exploit