Vulnerability Name:

CVE-2008-4687 (CCN-45942)

Assigned:2008-10-16
Published:2008-10-16
Updated:2018-05-13
Summary:manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
7.5 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
8.3 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-4687

Source: CONFIRM
Type: UNKNOWN
http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php?r1=5679&r2=5678&pathrev=5679

Source: CCN
Type: SA32314
Mantis "sort" PHP Code Execution Vulnerability

Source: SECUNIA
Type: Vendor Advisory
32314

Source: SECUNIA
Type: UNKNOWN
32975

Source: SREASON
Type: UNKNOWN
4470

Source: CCN
Type: SourceForge.net: Files
Mantis, File Release Notes and Changelog, Release Name: 1.1.4

Source: CCN
Type: GLSA-200812-07
Mantis: Multiple vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200812-07

Source: CCN
Type: Mantis Bug Tracker Web site
Mantis Bug Tracker

Source: CONFIRM
Type: UNKNOWN
http://www.mantisbt.org/bugs/changelog_page.php

Source: CCN
Type: Mantis Bug ID: 0009704
Remote Code Execution in manage_proj_page.php

Source: CONFIRM
Type: UNKNOWN
http://www.mantisbt.org/bugs/view.php?id=0009704

Source: MLIST
Type: UNKNOWN
[oss-security] 20081019 CVE request: mantisbt < 1.1.4: RCE

Source: CCN
Type: OSVDB ID: 49157
Mantis manage_proj_page.php sort Parameter Arbitrary PHP Code Execution

Source: BID
Type: UNKNOWN
31789

Source: CCN
Type: BID-31789
Mantis 'manage_proj_page.php' PHP Code Injection Vulnerability

Source: CONFIRM
Type: UNKNOWN
https://bugs.gentoo.org/show_bug.cgi?id=242722

Source: XF
Type: UNKNOWN
mantis-sort-code-execution(45942)

Source: XF
Type: UNKNOWN
mantis-sort-code-execution(45942)

Source: CCN
Type: Packet Storm Security [05-09-2018]
Mantis manage_proj_page PHP Code Execution

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [05-10-2018]

Source: EXPLOIT-DB
Type: UNKNOWN
44611

Source: EXPLOIT-DB
Type: UNKNOWN
6768

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mantis:mantis:0.19.3:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:0.19.4:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:*:*:*:*:*:*:*:* (Version <= 1.1.3)

    • Configuration CCN 1:
  • cpe:/a:mantis:mantis:0.19.4:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:0.19.3:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mantis:mantis:1.0.7:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    mantis mantis 0.19.3
    mantis mantis 0.19.4
    mantis mantis 1.0.1
    mantis mantis 1.0.2
    mantis mantis 1.0.3
    mantis mantis 1.0.4
    mantis mantis 1.0.5
    mantis mantis 1.0.6
    mantis mantis 1.0.7
    mantis mantis 1.0.8
    mantis mantis 1.1.1
    mantis mantis 1.1.2
    mantis mantis *
    mantis mantis 0.19.4
    mantis mantis 1.0.1
    mantis mantis 1.0.8
    mantis mantis 1.1.1
    mantis mantis 0.19.3
    mantis mantis 1.0.2
    mantis mantis 1.0.3
    mantis mantis 1.0.4
    mantis mantis 1.0.5
    mantis mantis 1.0.6
    mantis mantis 1.1
    mantis mantis 1.1.2
    mantis mantis 1.1.3
    mantis mantis 1.0.7
    gentoo linux *