Remote Code Execution in Mantis by Easily Manipulated Sort Parameter
CVE-2008-4687
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC🟣 EPSS 67%
What is CVE-2008-4687?
The vulnerability found in Mantis Bug Tracker prior to version 1.1.4 allows remote authenticated users to inject and execute arbitrary PHP code. This exploitation occurs through manipulation of the 'sort' parameter within 'manage_proj_page.php', leading to unsafe processing in the 'multi_sort' function of 'core/utility_api.php'. By exploiting this flaw, malicious users can potentially gain unauthorized access and control over the affected system.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.