PT-2014-4576 · Mantisbt · Mantisbt

Damien Regad · Publicado 2014-03-05 · Atualizado 2026-05-06 · CVE-2014-2238

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.13 through 1.2.16

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the filter config id parameter in the manage configuration page, specifically in the adm config report.php file.

Recommendations For versions 1.2.13 through 1.2.16, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the adm config report.php page and avoid using the filter config id parameter until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-2238

Produtos afetados

Mantisbt

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/mantisbt_admin_sqli.rb · Exploit
• 🔥 http://securityfocus.com/bid/65903 · Exploit
• http://mantisbt.org/blog/?p=288 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91563 · Nota
• http://mantisbt.domainunion.de/bugs/view.php?id=17055 · Aviso do Fabricante
• http://seclists.org/oss-sec/2014/q1/456 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2238 · Nota de Segurança
• http://seclists.org/oss-sec/2014/q1/490 · Correção
• https://t.me/cveNotify/162450 · Publicação no Telegram