PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3091     A cross-site scripting vulnerability allows attackers to     inject arbitrary web script or HTML.

  - CVE-2005-3335     A file inclusion vulnerability allows remote attackers     to execute arbitrary PHP code and include arbitrary     local files.

  - CVE-2005-3336     A SQL injection vulnerability allows remote attackers to     execute arbitrary SQL commands.

  - CVE-2005-3338     Mantis can be tricked into displaying the otherwise     hidden real mail address of its users.

Secunia Research reports :

Input passed to the 't_core_path' parameter in 'bug_sponsorship_list_view_inc.php' isn't properly verified, before it used to include files. This can be exploited to include arbitrary files from external and local resources.

The remote host is affected by the vulnerability described in GLSA-200510-24 (Mantis: Multiple vulnerabilities)

    Mantis contains several vulnerabilities, including:
    a remote file inclusion vulnerability     a SQL injection vulnerability     multiple cross site scripting vulnerabilities     multiple information disclosure vulnerabilities   Impact :

    An attacker could exploit the remote file inclusion vulnerability to     execute arbitrary script code, and the SQL injection vulnerability to     access or modify sensitive information from the Mantis database.
    Furthermore the cross-site scripting issues give an attacker the     ability to inject and execute malicious script code or to steal     cookie-based authentication credentials, potentially compromising the     victim's browser. An attacker could exploit other vulnerabilities to     disclose information.
  Workaround :

    There is no known workaround at this time.

The remote version of Mantis suffers from a remote file inclusion vulnerability.  Provided PHP's 'register_globals' setting is enabled, An attacker may be able to leverage this issue to read arbitrary files on the local host or to execute arbitrary PHP code, possibly taken from third-party hosts. 

In addition, the installed version reportedly may be prone to SQL injection, cross-site scripting, and information disclosure attacks.

The remote host seems to be running a vulnerable version of Mantis, a bug tracker web application written in PHP. It is reported that versions up to 0.19.3 are prone to multiple HTML and SQL injection flaws that would allow an attacker to upload or execute arbitrary code as well as manipulate database data.

ID	Name	Product	Family	Severity
22771	Debian DSA-905-1 : mantis - several vulnerabilities	Nessus	Debian Local Security Checks	high
21458	FreeBSD : mantis -- 't_core_path' file inclusion vulnerability (82a41084-6ce7-11da-b90c-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
20117	GLSA-200510-24 : Mantis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
20093	Mantis < 0.19.3 Multiple Vulnerabilities	Nessus	CGI abuses	medium
3173	Mantis < 0.19.3 Multiple Injection Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-3335

critical

Tenable Plugins

high

high

high

medium

high