[-] Software Link:
[-] Affected Versions:
All versions from 1.2.0 to 1.2.17.
[-] Vulnerability Description:
The vulnerable code is located in the /plugins/XmlImportExport/ImportXml.php script:
User input passed through the "description" field (and the "issuelink" attribute) of the uploaded XML file when importing data through the Import/Export plugin is not properly sanitized before being used in a "preg_replace()" call with the 'e' modifier at line 113. This can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by uploading a specially crafted XML file. Successful exploitation of this vulnerability requires the Import/Export plugin to be enabled (disabled by default).
Update to version 1.2.18.
[-] Disclosure Timeline:
[04/10/2014] - Issue reported to http://www.mantisbt.org/bugs/view.php?id=17725 [05/10/2014] - CVE number requested [06/10/2014] - CVE number assigned [01/11/2014] - Issue fixed on GitHub [08/11/2014] - Public disclosure by the vendor on the OSS mailing list [23/12/2014] - Publication of this advisory
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-7146 to this vulnerability.
Vulnerability discovered by Egidio Romano.
[-] Original Advisory: