CVE-2014-8554
MantisBT < 1.2.18 - SQL Injection via mc_project_get_attachments project_id Parameter
Title source: llmDescription
SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609.
References (8)
Core 8
Core References
Exploit mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2014/q4/487
Exploit, Vendor Advisory x_refsource_confirm
http://www.mantisbt.org/bugs/view.php?id=17812
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/70856
Mailing List mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2014/q4/479
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/98457
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/62101
Various Sources x_refsource_confirm
http://www.mantisbt.org/bugs/view.php?id=16880
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2015/dsa-3120
Scores
EPSS
0.0245
EPSS Percentile
82.6%
Details
CWE
CWE-89
Status
published
Products (32)
mantisbt/mantisbt
0.18.0
mantisbt/mantisbt
0.19.0 (4 CPE variants)
mantisbt/mantisbt
0.19.0a1
mantisbt/mantisbt
0.19.0a2
mantisbt/mantisbt
0.19.1
mantisbt/mantisbt
0.19.2
mantisbt/mantisbt
0.19.3
mantisbt/mantisbt
0.19.4
mantisbt/mantisbt
0.19.5
mantisbt/mantisbt
1.0.0 (9 CPE variants)
... and 22 more
Published
Nov 13, 2014
Tracked Since
Feb 18, 2026