MantisBT 'view_all_set.php' Multiple SQL Injection Vulnerabilities

Bugtraq ID:	71298
Class:	Input Validation Error
CVE:	CVE-2014-9089
Remote:	Yes
Local:	No
Published:	Nov 25 2014 12:00AM
Updated:	Jan 12 2015 01:01AM
Credit:	Edwin Gozeling from ITsec Security Services
Vulnerable:	Mantisbt Mantisbt 1.2.9 Mantisbt Mantisbt 1.2.8 Mantisbt Mantisbt 1.2.7 Mantisbt Mantisbt 1.2.6 Mantisbt Mantisbt 1.2.4 Mantisbt Mantisbt 1.2.3 Mantisbt Mantisbt 1.2.2 Mantisbt Mantisbt 1.2.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

MantisBT 'view_all_set.php' Multiple SQL Injection Vulnerabilities

MantisBT is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MantisBT 1.2.17 and prior are vulnerable.

MantisBT 'view_all_set.php' Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URI is available:

http://www.example.com/view_all_set.php?sort=id,severity,status+DESC+INTO+OUTFILE+%27/tmp/sql_dump.txt%27+--&dir=ASC,ASC,ASC&type=2

MantisBT 'view_all_set.php' Multiple SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MantisBT 'view_all_set.php' Multiple SQL Injection Vulnerabilities

References: