CVE-2014-2238 SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via....
MediumCVSS 6.5
EPSS 11.3%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mantisbt | = 1.2.13 | No fix listed |
| mantisbt | = 1.2.14 | No fix listed |
| mantisbt | = 1.2.15 | No fix listed |
| mantisbt | = 1.2.16 | No fix listed |
References
- mantisbt.domainunion.de vendor-advisory
- [oss-security] 20140228 CVE request: MantisBT 1.2.13 SQL injection vulnerability mailing-list
- [oss-security] 20140304 Re: CVE request: MantisBT 1.2.13 SQL injection vulnerability mailing-list patch
- www.mantisbt.org vendor-advisory
- 65903 exploit vdb-entry
- mantisbt-admconfigreport-sql-injection(91563) vdb-entry