PT-2002-2116 · Mantis · Mantis

Publicado

2002-10-04

·

Atualizado

2017-10-10

·

CVE-2002-1113

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Mantis versions 0.17.3 and earlier
Description: The issue allows remote attackers to execute arbitrary PHP code. This is achieved by modifying the g jpgraph path parameter to reference the location of the PHP code.
Recommendations: For versions 0.17.3 and earlier, consider restricting access to the summary graph functions.php file until a patch is available. As a temporary workaround, avoid using the g jpgraph path parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2002-1113
DSA-153

Produtos afetados

Mantis