CVE-2014-8598
MantisBT < 1.2.17 - Unauthenticated Arbitrary File Upload and Information Disclosure via XML Import/Export Plugin
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-8598.
PoCs published by Metasploit, Egidio Romano, including Metasploit module exploits/multi/http/mantisbt_php_exec.
AI-analyzed exploit summary This Metasploit module exploits a post-auth PHP code injection vulnerability in MantisBT's XmlImportExport plugin (CVE-2014-8598). It leverages the /e modifier in preg_replace() to execute arbitrary PHP code via crafted XML input, bypassing user level checks to allow exploitation even with anonymous access.
Description
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
Exploits (2)
This Metasploit module exploits a post-auth PHP code injection vulnerability in MantisBT's XmlImportExport plugin (CVE-2014-8598). It leverages the /e modifier in preg_replace() to execute arbitrary PHP code via crafted XML input, bypassing user level checks to allow exploitation even with anonymous access.
This Metasploit module exploits a post-authentication PHP code injection vulnerability in MantisBT's XmlImportExport plugin (CVE-2014-8598). It leverages the /e modifier in preg_replace() to execute arbitrary PHP code via crafted XML input, bypassing user level checks to allow exploitation even with anonymous access.