RCE in Mantis
CVE-2008-4687
manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.0 (High). Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.675 (99.3th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.675 · newest: 0.675 · change: 0.000
Affected products
- Mantis — versions 0.19.3, 0.19.4, 1.0.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bugs.gentoo.org/show_bug.cgi
- secunia.com/advisories/32975 (third-party-advisory)
- mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/cor…
- www.securityfocus.com/bid/31789 (vdb-entry)
- www.gentoo.org/security/en/glsa/glsa-200812-07.xml (vendor-advisory)
- www.mantisbt.org/bugs/view.php
- www.mantisbt.org/bugs/changelog_page.php
- www.exploit-db.com/exploits/44611/ (exploit)
- secunia.com/advisories/32314 (Vendor Advisory, third-party-advisory)
- www.openwall.com/lists/oss-security/2008/10/19/1 (mailing-list)
Frequently asked questions
- What is CVE-2008-4687?
- CVE-2008-4687 is a vulnerability in Mantis, classified under Code Injection. Published 2008-10-22.
- Is CVE-2008-4687 known to be exploited?
- 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.