Date: Wed, 26 Nov 2014 00:13:34 +0100 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Subject: CVE Request: MantisBT SQL injection in view_all_set.php Description: Both the 'sort' and 'dir' parameters to view_all_set.php are insufficiently validated before they are used in queries by view_all_bug_page.php. Both parameters are split into chunks on ','. After splitting, only the first two values are validated. By supplying a third value, SQL injection can be performed. Affected versions: <= 1.2.17 Fixed in versions: 1.2.18 (not yet released) Patch: See Github  Credit: Issue was discovered by Edwin Gozeling from ITsec Security Services (http://www.itsec.nl/), and fixed by Victor Boctor (MantisBT Developer) References: Further details available in our issue tracker  D. Regad MantisBT Developer http://www.mantisbt.org  http://github.com/mantisbt/mantisbt/commit/b0021673  https://www.mantisbt.org/bugs/view.php?id=17841
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.