CVE-2008-4687

🗓️ 22 Oct 2008 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequence

Reporter	Title	Published	Views	Family All 19
0day.today	Mantis manage_proj_page PHP Code Execution Exploit	10 May 201800:00	–	zdt
FreeBSD	mantis -- php code execution vulnerability	17 Oct 200800:00	–	freebsd
Circl	CVE-2008-4687	16 Oct 200800:00	–	circl
Cvelist	CVE-2008-4687	22 Oct 200817:00	–	cvelist
Exploit DB	Mantis Bug Tracker 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)	10 May 201800:00	–	exploitdb
Tenable Nessus	FreeBSD : mantis -- php code execution vulnerability (af2745c0-c3e0-11dd-a721-0030843d3802)	8 Dec 200800:00	–	nessus
Tenable Nessus	GLSA-200812-07 : Mantis: Multiple vulnerabilities	3 Dec 200800:00	–	nessus
Gentoo Linux	Mantis: Multiple vulnerabilities	2 Dec 200800:00	–	gentoo
Metasploit	Mantis manage_proj_page PHP Code Execution	14 Apr 201812:51	–	metasploit
NVD	CVE-2008-4687	22 Oct 200818:00	–	nvd

NVD

Node

mantis mantisRange≤1.1.3

Source	Link
mantisbt	www.mantisbt.org/bugs/view.php
securityfocus	www.securityfocus.com/bid/31789
exploit-db	www.exploit-db.com/exploits/6768
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/45942
openwall	www.openwall.com/lists/oss-security/2008/10/19/1
gentoo	www.gentoo.org/security/en/glsa/glsa-200812-07.xml
mantisbt	www.mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php
secunia	www.secunia.com/advisories/32314
bugs	www.bugs.gentoo.org/show_bug.cgi
mantisbt	www.mantisbt.org/bugs/changelog_page.php

Parameter	Position	Path	Description	CWE
sort	request body	/mantisbt/manage_proj_page.php	Post-authentication remote code execution via the sort parameter in manage_proj_page.php	CWE-94

23 Apr 2026 00:35Current

7High risk

Vulners AI Score7

CVSS 29

EPSS0.79225