ID CVE-2002-1110
Summary Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to account_update.php.
References
Vulnerable Configurations
  • cpe:2.3:a:mantis:mantis:0.15.3:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.4:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.5:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.6:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.7:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.8:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.9:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.10:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.11:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.15.12:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.15.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.16.0:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.16.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.16.1:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.16.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.17.0:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.17.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.17.1:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.17.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mantis:mantis:0.17.2:*:*:*:*:*:*:*
    cpe:2.3:a:mantis:mantis:0.17.2:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 18-10-2016 - 02:23)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
refmap via4
bid 5510
bugtraq 20020819 [Mantis Advisory/2002-01] SQL poisoning vulnerability in Mantis
confirm http://mantisbt.sourceforge.net/advisories/2002/2002-01.txt
debian DSA-153
xf mantis-user-sql-injection(9897)
Last major update 18-10-2016 - 02:23
Published 04-10-2002 - 04:00
Last modified 18-10-2016 - 02:23
Back to Top