CVE-2014-1609 : Detail

CVE-2014-1609

SQL Injection
A03-Injection
0.84%V3
Network
2014-03-20
15h00 +00:00
2017-01-04
16h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Products Mentioned

Configuraton 0

Debian>>Debian_linux >> Version 7.0

Configuraton 0

Mantisbt>>Mantisbt >> Version To (including) 1.2.15

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.0

Mantisbt>>Mantisbt >> Version 1.2.1

Mantisbt>>Mantisbt >> Version 1.2.2

Mantisbt>>Mantisbt >> Version 1.2.3

Mantisbt>>Mantisbt >> Version 1.2.4

Mantisbt>>Mantisbt >> Version 1.2.5

Mantisbt>>Mantisbt >> Version 1.2.6

Mantisbt>>Mantisbt >> Version 1.2.7

Mantisbt>>Mantisbt >> Version 1.2.8

Mantisbt>>Mantisbt >> Version 1.2.9

Mantisbt>>Mantisbt >> Version 1.2.10

Mantisbt>>Mantisbt >> Version 1.2.11

Mantisbt>>Mantisbt >> Version 1.2.13

Mantisbt>>Mantisbt >> Version 1.2.14

References

http://www.securityfocus.com/bid/65461
Tags : vdb-entry, x_refsource_BID
http://www.debian.org/security/2014/dsa-3030
Tags : vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/61432
Tags : third-party-advisory, x_refsource_SECUNIA