CVE-2014-2238

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://mantisbt.domainunion.de/bugs/view.php?id=17055Vendor Advisory
http://seclists.org/oss-sec/2014/q1/456
http://seclists.org/oss-sec/2014/q1/490Patch
http://www.mantisbt.org/blog/?p=288Vendor Advisory
http://www.securityfocus.com/bid/65903Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/91563
http://mantisbt.domainunion.de/bugs/view.php?id=17055Vendor Advisory
http://seclists.org/oss-sec/2014/q1/456
http://seclists.org/oss-sec/2014/q1/490Patch
http://www.mantisbt.org/blog/?p=288Vendor Advisory
http://www.securityfocus.com/bid/65903Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/91563

Timeline

Published: Mar 5, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-22407.5Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a CVE-2014-22416.8The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check CVE-2014-22424.3includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use o CVE-2014-22435.8includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user tok CVE-2014-22444.3Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x an CVE-2014-22456.0SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify CVE-2014-22464.3Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 CVE-2014-22475.8The integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject headers vi CVE-2014-22484.3Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote CVE-2014-22495.8Cross-site request forgery (CSRF) vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CP CVE-2014-22508.3The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which make CVE-2014-22518.3The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which ma