CVE-2008-4687 — AI Deep Analysis Summary

🚨 **Essence**: Mantis `manage_proj_page.php` allows **Remote Code Execution (RCE)**. Hackers inject PHP sequences via the `sort` parameter. 💥 **Consequences**: Arbitrary code execution on the server.…

🛡️ **Root Cause**: **PHP Code Injection**. The `sort` parameter is passed directly to `create_function()` inside `core/utility_api.php`'s `multi_sort` function.…

📦 **Affected**: **Mantis Bug Tracker**. Specifically versions **before 1.1.4**. 📅 **Published**: Oct 22, 2008. Older installations are at risk!

💀 **Hacker Power**: Execute **arbitrary PHP code**. 📂 **Impact**: Full server control. Read/write files, run commands, escalate privileges. Data breach imminent!

🔐 **Threshold**: **Medium**. Requires **Remote Authenticated Users**. 🚫 Not fully open, but easy for logged-in users to exploit. No complex config needed!

🔥 **Exploits**: **YES**. Public Python exploits exist on GitHub (e.g., `CVE-2008-4687-exploit`, `mantis_rce`). ⚠️ Wild exploitation is possible!

🔍 **Self-Check**: Scan for Mantis versions < 1.1.4. 🧪 Test `manage_proj_page.php` with malicious `sort` parameters containing PHP sequences. Look for `create_function` usage in `utility_api.php`.

✅ **Fixed**: Yes! Upgrade to **Mantis 1.1.4 or later**. 🛠️ Official patch resolves the injection flaw in the sorting function.

🚧 **No Patch?**: **Mitigation**: Restrict access to `manage_proj_page.php`. 🚫 Disable PHP execution in upload directories. 🛑 Limit user privileges. Input validation is key!

🚨 **Urgency**: **HIGH**. RCE is critical! Even though old, unpatched systems are still vulnerable. 🏃 **Action**: Patch immediately or isolate the system!