Detections
Analytics
MantisBT 'db_type' Parameter Local File Inclusion
medium Nessus Plugin ID 51359
Language:
Synopsis
The remote web server contains a web application that is susceptible to a local file inclusion attack.Description
The MantisBT install on the remote host fails to sanitize user input to the 'db_type' parameter of the 'admin/upgrade_unattended.php' script before using it to include PHP code.Regardless of PHP's 'register_globals' and 'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this vulnerability to view arbitrary files or possibly execute arbitrary PHP code on the remote host, subject to the privileges of the web server user id.
Although Nessus has not checked for it, the installed version is also likely to be affected by a cross-site scripting vulnerability involving the same parameter / script combination.
Solution
Upgrade to MantisBT 1.2.4 or later.See Also
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4984.php
Plugin Details
Severity: Medium
ID: 51359
File Name: mantis_db_type_lfi.nasl
Version: 1.19
Type: remote
Family: CGI abuses
Published: 12/22/2010
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Medium
Base Score: 5.1
Temporal Score: 4.2
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:mantisbt:mantisbt
Required KB Items: installed_sw/MantisBT
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/14/2010
Vulnerability Publication Date: 12/14/2010
Exploitable With
Elliot (Mantisbt < 1.2.4 LFI)
Reference Information
CVE: CVE-2010-4350
BID: 45399