BID:5510

Mantis Account Update SQL Injection Vulnerability

Info

Mantis Account Update SQL Injection Vulnerability

Bugtraq ID:	5510
Class:	Input Validation Error
CVE:	CVE-2002-1110
Remote:	Yes
Local:	No
Published:	Aug 19 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Announced by Jeroen Latour <[email protected]>.
Vulnerable:	Mantis Mantis 0.17.2 Mantis Mantis 0.17.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 Mantis Mantis 0.17 .0 Mantis Mantis 0.16.1 Mantis Mantis 0.16 .0 Mantis Mantis 0.15.12 Mantis Mantis 0.15.11 Mantis Mantis 0.15.10 Mantis Mantis 0.15.9 Mantis Mantis 0.15.8 Mantis Mantis 0.15.7 Mantis Mantis 0.15.6 Mantis Mantis 0.15.5 Mantis Mantis 0.15.4 Mantis Mantis 0.15.3

Not Vulnerable:	Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 Mantis Mantis 0.17.3

Discussion

Mantis Account Update SQL Injection Vulnerability

It has been reported that Mantis is vulnerable to a SQL injection attack. The affected component is 'account_update.php', which is associated with user account modifications. It is confirmed that users may exploit this vulnerability to elevate their Mantis user privileges.

Exploit / POC

Mantis Account Update SQL Injection Vulnerability

This vulnerability can be exploited with a web browser.

Solution / Fix

Mantis Account Update SQL Injection Vulnerability

Solution:
The vendor has included a source code fix. This issue may be addressed by inserting the following lines into account_update.php somewhere in a PHP block prior to where the SQL queries are executed:

$f_username = addslashes($f_username);
$f_email = addslashes($f_email);

This vulnerability has been patched:

Mantis Mantis 0.15.10