CVE-2014-1608

SQL injection vulnerability in the mcifileget function in api/soap/mcfileapi.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mcissueattachmentget SOAP request...

CVE-2014-1608

The CVE-2014-1608 issue affects MantisBT affected versions prior to 1.2.16. It arises from the mci_file_get function in api/soap/mc_file_api.php, where unsafely constructed SQL via the db_query path in the mc_issue_attachment_get SOAP request, allowing remote attackers to execute arbitrary SQL co...

CVE-2014-1608: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the mcifileget function in api/soap/mcfileapi.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mcissueattachmentget SOAP request...

PT-2014-4253

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.16 Description The issue allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a "mc issue attachment get" SOAP request. This is due to a SQL injection vulnerability in the mci...

CVE-2014-2238

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

Sql injection

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

CVE-2014-2238

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

CVE-2014-2238

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

CVE-2014-2238

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

CVE-2014-2238

CVE-2014-2238 is a SQL injection vulnerability in MantisBT’s admin_config_report.php used by versions 1.2.13 through 1.2.16. The issue arises in the handling of the filter_config_id parameter, enabling a remote authenticated administrator to execute arbitrary SQL commands. Multiple connected sour...

MantisBT 'adm_config_report.php' SQL注入漏洞

Bugtraq ID:65903 CVE ID:CVE-2014-2238 MantisBT是一个基于web的流行bug跟踪系统。 MantisBT 'admconfigreport.php'不正确过滤用户提交的POST参数数据，允许远程攻击者利用漏洞提交特制的SQL查询，可操作或获取数据库数据。 0 MantisBT 1.2.16 目前没有详细解决方案提供： http://www.mantisbt.org This file is part of the Metasploit Framework and may be subject to redistribution and...

PT-2014-4576

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.13 through 1.2.16 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the filter config id parameter in the manage configuration page, specifically in t...

CVE-2014-2238: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the manage configuration page admconfigreport.php in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter...

MantisBT Admin SQL Injection Arbitrary File Read Vulnerability

MantisBT versions 1.2.16 and below Metasploit module that leverages a remote SQL injection vulnerability to perform an arbitrary file read. Administrative credentials required. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please s...

MantisBT Admin SQL Injection Arbitrary File Read

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "MantisBT Admin SQ...

MantisBT 1.2.16 SQL Injection

============================================================== Title ...| MantisBT 1.2.16 Version .| 1.2.16 Date ....| 28.02.2014 Found ...| HauntIT Blog Home ....| http://www.mantisbt.org ============================================================== + for authorized user...

MantisBT Admin SQL Injection Arbitrary File Read

Versions 1.2.13 through 1.2.16 are vulnerable to a SQL injection attack if an attacker can gain access to administrative credentials. This vuln was fixed in 1.2.17. Module Options msf use auxiliary/gather/mantisbt/adminsqli msf undefinedadminsqli show actions ...actions... msf undefinedadminsqli...

[oCERT-2014-001] MantisBT input sanitization errors

2014-001 MantisBT input sanitization errors Description: The MantisBT web-based bugtracking system suffers from SQL injection vulnerabilities caused by insufficient input sanitization. The MantisBT SOAP API uses the unsafe dbquery function allowing a specially crafted tag within the envelope of a...

CVE-2013-4460

Cross-site scripting XSS vulnerability in accountsponsorpage.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name...

Cross site scripting

Cross-site scripting XSS vulnerability in accountsponsorpage.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name...