CVE-2014-1608

MantisBT < 1.2.16 - SQL Injection via SOAP mc_issue_attachment_get Request

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.

References (8)

Core 8
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1063111
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/103118
US Government Resource x_refsource_misc
http://www.ocert.org/advisories/ocert-2014-001.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3030
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/65445
Various Sources x_refsource_confirm
http://www.mantisbt.org/bugs/view.php?id=16879
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61432

Scores

EPSS 0.0314
EPSS Percentile 86.5%

Details

CWE
CWE-89
Status published
Products (16)
debian/debian_linux 7.0
mantisbt/mantisbt 1.2.0 (6 CPE variants)
mantisbt/mantisbt 1.2.1
mantisbt/mantisbt 1.2.2
mantisbt/mantisbt 1.2.3
mantisbt/mantisbt 1.2.4
mantisbt/mantisbt 1.2.5
mantisbt/mantisbt 1.2.6
mantisbt/mantisbt 1.2.7
mantisbt/mantisbt 1.2.8
... and 6 more
Published Mar 18, 2014
Tracked Since Feb 18, 2026