Eval Injection Vulnerability in Mantis Bug Tracker by MantisBT
CVE-2008-3332

Currently unrated

Key Information:

Vendor

Mantis

Status
Mantis
Vendor
CVE Published:
27 July 2008

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2008-3332?

An eval injection vulnerability exists in the adm_config_set.php file of Mantis Bug Tracker versions prior to 1.1.2. This flaw allows remote authenticated administrators to execute arbitrary code due to improper handling of the 'value' parameter. Attackers who gain administrative access could exploit this vulnerability to perform unauthorized actions on the application, potentially compromising the entire system and its data integrity.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2008-3332 - Proof of Concept

References

http://www.mantisbt.org/bugs/changelog_page.php
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/42550
vdb-entryx_refsource_XF
http://secunia.com/advisories/30270
third-party-advisoryx_refsource_SECUNIA

EPSS Score

9% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.