CVE-2014-8554

The CVE-2014-8554 entry concerns MantisBT prior to 1.2.18, where the function mc_project_get_attachments in api/soap/mc_project_api.php is vulnerable to SQL injection via the project_id parameter. This results from an incomplete fix for CVE-2014-1609 and allows remote attackers to execute arbitra...