kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

- Document mantis - PHP Code Execution Vulnerability

Browse source 
PR:		based on 129438
Submitted by:	Eygene Ryabinkin <rea-fbsd@codelabs.ru>
This commit is contained in:
Martin Wilke 2008-12-06 22:00:53 +00:00
parent a06b63d720
commit cf6e091a74
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=223901
1 changed files with 30 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
security/vuxml/vuln.xml
View file

@ -34,6 +34,36 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="af2745c0-c3e0-11dd-a721-0030843d3802">
<topic>mantis -- php code execution vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>secunia reports:</p>
<blockquote cite="http://secunia.com/advisories/32314/">
<p>EgiX has discovered a vulnerability in Mantis, which can be
exploited by malicious users to compromise a vulnerable system.</p>
<p>Input passed to the "sort" parameter in manage_proj_page.php is not
properly sanitised before being used in a "create_function()" call.
This can be exploited to execute arbitrary PHP code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-4687</cvename>
<url>http://secunia.com/advisories/32314/</url>
</references>
<dates>
<discovery>2008-10-17</discovery>
<entry>2008-12-06</entry>
</dates>
</vuln>
<vuln vid="29255141-c3df-11dd-a721-0030843d3802">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>