Mantis Bugtracking System contains a flaw that may allow a malicious user to inject PHP code. The issue exists because Mantis fails to properly validate a variable used to call an included file. It is possible that the flaw may allow a remote attacker to induce PHP into including and processing remote files, that could be used to execute arbitrary commands on the server, resulting in a loss of integrity.

Upgrade to version 0.17.4a or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround:

Place the following code at the top of summary_graph_functions.php:

if ( isset($HTTP_GET_VARS['g_jpgraph_path']) ||
isset($HTTP_POST_VARS['g_jpgraph_path']) ||
isset($HTTP_COOKIE_VARS['g_jpgraph_path']) ) {
exit;
}:

• CVE ID: 2002-1113 (see also: NVD)
• Bugtraq ID: 5504
• ISS X-Force ID: 9829
• Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=102927873301965&w=2
• Other Advisory URL: http://marc.theaimsgroup.com/?l=bugtraq&m=102978924821040&w=2
• Vendor Specific Solution URL: http://www.debian.org/security/2002/dsa-153
• Vendor URL: http://www.mantisbt.org/
• Keyword: Mantis Advisory/2002-04

• Joao Gouveia - tharbadkaotik.org - Personal Page