| Description: | Summary:
MantisBT is prone to multiple vulnerabilities.
Vulnerability Insight:
Multiple flaws exist due to:
- an error in the 'mc_project_get_attachments' function in
api/soap/mc_project_api.php script which does not properly sanitize
user-supplied input before using it in SQL queries.
- the view_all_bug_page.php script not properly sanitizing user-supplied
input to the 'sort' and 'dir' parameters to view_all_set.php.
- null byte poisoning in LDAP authentication.
- the copy_field.php script which does not validate input to the 'dest_id'
parameter before returning it to users.
- input passed via the 'filter' parameter is not properly sanitized by the
'current_user_get_bug_filter' function in the core/current_user_api.php script.
- an error in the CAPTCHA system that is triggered upon registration.
- an error in user rights to see a given ticket and its related issues.
- application does not validate the 'return' parameter upon submission to
the /bugs/login_page.php script.
- input passed via the 'handler_id' parameter is not properly sanitized when
passed via the bug_report.php script.
- an error in the 'mci_account_get_array_by_id' function in the
api/soap/mc_account_api.php script.
Vulnerability Impact:
Successful exploitation will allow attackers
to inject or manipulate SQL queries in the backend database, execute arbitrary
script code in a user's browser session within the trust relationship between
their browser and the server, execute arbitrary PHP code, bypass security
mechanisms, conduct open redirect and phishing attacks, assign arbitrary issues,
and obtain sensitive information.
Affected Software/OS:
MantisBT version 1.2.17 and earlier.
Solution:
Update to version 1.2.18 or later.
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
