Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mcprojectgetattachments function in api/soap/mcprojectapi.php; the (2) newsgetlimitedrows function in core/newsapi.php; the (3) summaryprintbyenum, (4) summaryprintbyage, (5) summaryprintbydeveloper, (6) summaryprintbyreporter, or (7) summaryprintbycategory function in core/summaryapi.php; the (8) createbugenumsummary or (9) enumbuggroup function in plugins/MantisGraph/core/graphapi.php; (10) buggraphbycategory.php or (11) buggraphbystatus.php in plugins/MantisGraph/pages/; or (12) projdocpage.php, related to use of the dbquery function, a different vulnerability than CVE-2014-1608.
SQL injection issues were discovered in MantisBT, an open source issue tracker.
CVE-2014-1608 patch: https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102
CVE-2014-1609 patch: https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f
It was reported that versions 1.1.0a4 to 1.2.15 are affected.
References: http://www.ocert.org/advisories/ocert-2014-001.html
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.
The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.
The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.