Description
manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Mantis manage_proj_page PHP Code Execution
exploit/multi/http/mantisbt_manage_proj_page_rce
Exploit-DB 2
- Mantis Bug Tracker 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit) EDB-44611 · remote · May 10, 2018 · verified
- Mantis Bug Tracker 1.1.3 - Remote Code Execution EDB-6768 · webapps · Oct 16, 2008 · verified
GitHub 2 repositories
-
nmurilo/CVE-2008-4687-exploit ★ 3 · May 30, 2020
-
twisted007/mantis_rce ★ 1 · Sep 25, 2021
Python script to obtain RCE on Mantis Bug Tracker prior to version 1.2.x Check CVE-2008-4687 for additional information
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://bugs.gentoo.org/show_bug.cgi?id=242722
- 32975 third-party-advisory
- http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php?r1=5679&r2=5678&pathrev=5679
- 31789 vdb-entry
- GLSA-200812-07 vendor-advisory
- http://www.mantisbt.org/bugs/view.php?id=0009704
- http://www.mantisbt.org/bugs/changelog_page.php
- 44611 exploit
- 32314 third-party-advisory
- [oss-security] 20081019 CVE request: mantisbt < 1.1.4: RCE mailing-list
- 6768 exploit
- mantis-sort-code-execution(45942) vdb-entry
- 4470 third-party-advisory