VDB
CVE-2008-4687
CVE-2008-4687
PUBLISHED
CVSS 9 CRITICAL
manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.
EPSS 67.45% · 99.2th percentile
Risk Scores
CVSS 2.0
9
EPSS Score
67.45%
99.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mantis | mantis | 1.0.2, 0, 0.19.3 |
| n/a | n/a | n/a |
Timeline
- Oct 22, 2008 CVE Published
- May 10, 2018 PoC Published
- May 10, 2018 PoC Published
- May 29, 2018 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
References
- http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php?r1=5679&r2=5678&pathrev=5679 url
- GLSA-200812-07 vendor-advisory
- 44611 exploit
- 6768 exploit
- https://bugs.gentoo.org/show_bug.cgi?id=242722 url
- 32975 third-party-advisory
- 31789 vdb
- http://www.mantisbt.org/bugs/view.php?id=0009704 url
- http://www.mantisbt.org/bugs/changelog_page.php url
- 32314 third-party-advisory
- [oss-security] 20081019 CVE request: mantisbt < 1.1.4: RCE mailing-list
- mantis-sort-code-execution(45942) vdb
- 4470 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2008-4687 advisory
- https://www.exploit-db.com/exploits/44611 url