Input validation error in MantisBT - CVE-2014-7146
Published: November 18, 2014 / Updated: August 9, 2020
Vulnerability identifier: #VU41095
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-7146
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.
Affected software
MantisBT
How to mitigate CVE-2014-7146
Install update from vendor's website.
Links to Public Exploits and PoC-codes
- Exploit #3863 - MantisBT XmlImportExport Plugin - PHP Code Injection (Metasploit) (August 9, 2020)
- Exploit #3808 - MantisBT 1.2.0a3 < 1.2.17 - XmlImportExport Plugin PHP Code Injection (Metasploit) (August 9, 2020)
- Exploit #3757 - MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability (August 9, 2020)
External References
- http://seclists.org/oss-sec/2014/q4/576
- http://secunia.com/advisories/62101
- http://www.debian.org/security/2015/dsa-3120
- http://www.mantisbt.org/bugs/view.php?id=17725
- http://www.securityfocus.com/bid/70993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98572
- https://github.com/mantisbt/mantisbt/commit/84017535
- https://github.com/mantisbt/mantisbt/commit/bed19db9