CVE-2020-28413: MantisBT SQL Injection Vulnerability in mc_project_get_users Function
Summary
CVE-2020-28413: MantisBT SQL Injection via mc_project_get_users function. Affects mantisbt/mantisbt versions < 2.24.4. Fixed in 2.24.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that helps teams manage software development projects. It provides features such as bug tracking, project management, and reporting. However, in version 2.24.3, it has a vulnerability that allows SQL injection through the mc_project_get_users function, which can compromise the integrity of the database.
Vulnerability Detail
In MantisBT version 2.24.3, a SQL injection vulnerability exists in the mc_project_get_users function via the 'access' parameter when accessed through the SOAP API. This vulnerability can allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data or manipulation of the database. The issue arises from insufficient input validation, making it possible for attackers to inject malicious SQL code.
How To Fix
Minimum fixed version
2.24.4
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.24.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the SOAP API or validate the 'access' parameter to ensure it only accepts predefined values. This can help mitigate the risk of SQL injection until the package is updated.
Conclusion
The SQL injection vulnerability in MantisBT version 2.24.3 poses a significant risk to users of the software. It is crucial to update to version 2.24.4 or later to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by allowing attackers to execute arbitrary SQL queries against a database.
If you are using MantisBT version 2.24.3 or earlier, your installation is vulnerable. You can check your version in the application settings or by looking at the composer.lock file.
An attacker could gain unauthorized access to sensitive data, modify or delete records, or execute administrative commands on the database, leading to data breaches or loss of integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file. You can also use the Vulert playground to check for vulnerabilities without signup.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
