Date: Sat, 29 Nov 2014 23:43:28 +0100 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Subject: CVE request: PHP Object Injection in MantisBT filter API Greetings, Please assign a CVE ID for the following issue. Description: In the function current_user_get_bug_filter(), the code loads a variable from $_GET['filter']/$_POST['filter'] and if it's not numeric, feeds it straight into unserialize() allowing an attacker to inject a PHP object. Affected versions: <= 1.2.17 Fixed in versions: 1.2.18 (not yet released) Patch: See Github  Credit: Issue was reported by Mathias Karlsson (http://mathiaskarlsson.me) as part of Offensive Security's bug bounty program . It was fixed by Paul Richards. References: Further details available in our issue tracker   http://github.com/mantisbt/mantisbt/commit/599364b2  http://www.mantisbt.org/bugs/view.php?id=17875  http://www.offensive-security.com/bug-bounty-program/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.