MantisBT - exploit.company

vendor:

MantisBT

by:

Gjoko 'LiquidWorm' Krstic

7,5

CVSS

HIGH

Local File Inclusion Vulnerability

CWE

Product Name: MantisBT

Affected Version From: <1.2.4

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: a:mantisbt_group:mantisbt

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft Windows XP Professional SP3 (English), Debian GNU/Linux (squeeze), Apache 2.2.14 (Win32), MySQL 5.1.41, PHP 5.3.1

2010

MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver. MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web browser should be able to function as a client. It is released under the terms of the GNU General Public License (GPL). Mantis Bug Tracker suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability when input passed thru the 'db_type' parameter (GET & POST) to upgrade_unattended.php script is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes.

Mitigation:

Upgrade to MantisBT version 1.2.4 or later.

Source

Exploit-DB raw data:

 MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

 
 Vendor: MantisBT Group
 Product web page: http://www.mantisbt.org
 Version affected: <1.2.4

 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP
 scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver.
 MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web
 browser should be able to function as a client. It is released under the terms of the GNU
 General Public License (GPL).

 Desc: Mantis Bug Tracker suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability
 when input passed thru the "db_type" parameter (GET & POST) to upgrade_unattended.php script is
 not properly verified before being used to include files. This can be exploited to include files
 from local resources with directory traversal attacks and URL encoded NULL bytes.



 ====================================================================================
 --> library/adodb/adodb.inc.php

 ...

 4109:
 4110: $file = ADODB_DIR."/drivers/adodb-".$db.".inc.php";
 4111: @include_once($file);

 ...

 ====================================================================================



 Tested on: Microsoft Windows XP Professional SP3 (English)
            Debian GNU/Linux (squeeze)
            Apache 2.2.14 (Win32)
            MySQL 5.1.41
            PHP 5.3.1

 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
                              liquidworm gmail com
                              Zero Science Lab - http://www.zeroscience.mk

 
 Advisory ID: ZSL-2010-4984
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4984.php
 Vendor Advisory URL: http://www.mantisbt.org/bugs/view.php?id=12607

 13.12.2010


 PoC:
 ----------

  Dork: Copyright+MantisBT Group

  LFI/FD: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00

 ----------