CVE-2008-4687 PoC — Mantis 'manage_proj_page.php' PHP代码注入漏洞

Source

https://github.com/nmurilo/CVE-2008-4687-exploit

Associated Vulnerability

Title:Mantis 'manage_proj_page.php' PHP代码注入漏洞 (CVE-2008-4687)
Description:manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.

Readme

# CVE-2008-4687-exploit
Quick and dirty python exploit for CVE-2008-4687.

Description by NIST:
manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to
execute arbitrary code via a sort parameter containing PHP sequences, which are 
processed by create_function within the multi_sort function in core/utility_api.php.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →