Mantis Bug Tracker <= 1.1.3 (utility_api.php) PHP Code Injection Vulnerability

Description:

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function() within the multi_sort() function in core/utility_api.php.

References:

• CVE-2008-4687
• BID-31789
• EDB-6768

Disclosure Date:

October 16, 2008