CVE-2014-9089: SQL Injection
Published Nov 28, 2014
·Updated
Multiple SQL injection vulnerabilities in viewallbugpage.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to viewallset.php.
Affected Software
2 affected components
Debian Debian Linux=1.2
MantisBT mantisbt<=1.2.17
Remediation
Event History
Nov 28, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9089?
CVE-2014-9089 is classified as a high severity vulnerability due to its ability to allow remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2014-9089?
To fix CVE-2014-9089, upgrade MantisBT to version 1.2.18 or later.
3
Which versions of MantisBT are affected by CVE-2014-9089?
CVE-2014-9089 affects MantisBT versions prior to 1.2.18.
4
Can CVE-2014-9089 be exploited without authentication?
Yes, CVE-2014-9089 can be exploited by remote attackers without requiring authentication.
5
What parameters are vulnerable in CVE-2014-9089?
The vulnerable parameters in CVE-2014-9089 are 'sort' and 'dir' in the view_all_bug_page.php.