CVE-2014-7146
MantisBT - Remote Code Execution via XmlImportExport Plugin Preg Replace
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-7146.
PoCs published by Metasploit, Egidio Romano, including Metasploit module exploits/multi/http/mantisbt_php_exec.
AI-analyzed exploit summary This Metasploit module exploits a post-authentication PHP code injection vulnerability in MantisBT's XmlImportExport plugin via the `preg_replace` function with the `/e` modifier. It allows authenticated attackers to execute arbitrary PHP code by uploading a maliciously crafted XML file.
Description
The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.
Exploits (3)
This Metasploit module exploits a post-authentication PHP code injection vulnerability in MantisBT's XmlImportExport plugin via the `preg_replace` function with the `/e` modifier. It allows authenticated attackers to execute arbitrary PHP code by uploading a maliciously crafted XML file.
This Metasploit module exploits a post-authentication PHP code injection vulnerability in MantisBT's XmlImportExport plugin (CVE-2014-7146). It leverages the /e modifier in preg_replace() to execute arbitrary PHP code via crafted XML input, bypassing user level checks to allow exploitation even by anonymous users.
This Metasploit module exploits a PHP code injection vulnerability in MantisBT's XmlImportExport plugin (CVE-2014-7146, CVE-2014-8598) by leveraging the /e modifier in preg_replace() to execute arbitrary PHP code via a crafted XML file. It supports authentication bypass via anonymous login if enabled.