CVE-2008-4687: Code Injection
manageprojpage.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by createfunction within the multisort function in core/utilityapi.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4687?
CVE-2008-4687 has a medium severity rating as it allows remote authenticated users to execute arbitrary code.
How do I fix CVE-2008-4687?
To fix CVE-2008-4687, you should upgrade Mantis to version 1.1.4 or later, which addresses this vulnerability.
Which versions of Mantis are affected by CVE-2008-4687?
CVE-2008-4687 affects Mantis versions prior to 1.1.4, including 0.19.3, 0.19.4, and various 1.0.x versions.
Can CVE-2008-4687 be exploited remotely?
Yes, CVE-2008-4687 can be exploited remotely by authenticated users through specially crafted sort parameters.
What is the attack vector for CVE-2008-4687?
The attack vector for CVE-2008-4687 involves manipulating the sort parameter in the manage_proj_page.php script, leading to arbitrary code execution.