Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user preferences page (account_prefs_update.php).

Secunia reports :

Some vulnerabilities have been reported in Mantis, which can be exploited by malicious users to compromise a vulnerable system and malicious people to conduct cross-site scripting and request forgery attacks.

Input passed to the 'filter_target' parameter in return_dynamic_filters.php is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

A vulnerability is caused due to the application allowing users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g.
add a new user with administrative privileges by enticing a logged-in administrator to visit a malicious site.

Input passed to the 'value' parameter in adm_config_set.php is not properly sanitised before being used in an 'eval()' statement. This can be exploited to e.g. execute arbitrary PHP commands via a specially crafted request.

Input passed to the 'language' parameter in account_prefs_update.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

The remote host is affected by the vulnerability described in GLSA-200809-10 (Mantis: Multiple vulnerabilities)

    Antonio Parata and Francesco Ongaro reported a Cross-Site Request     Forgery vulnerability in manage_user_create.php (CVE-2008-2276), a     Cross-Site Scripting vulnerability in return_dynamic_filters.php     (CVE-2008-3331), and an insufficient input validation in     adm_config_set.php (CVE-2008-3332). A directory traversal vulnerability     in core/lang_api.php (CVE-2008-3333) has also been reported.
  Impact :

    A remote attacker could exploit these vulnerabilities to execute     arbitrary HTML and script code, create arbitrary users with     administrative privileges, execute arbitrary PHP commands, and include     arbitrary files.
  Workaround :

    There is no known workaround at this time.

The remote host is running Mantis Bug Tracker.

The version of Mantis Bug Tracker installed on the remote host does not properly parse user-supplied data to the 'language' parameter of the 'account_prefs_update.php' script. An attacker can gain 'read' access to local files or execute arbitrary files that are already present on the web server.  An attacker exploiting this flaw would send a specially formatted 'language' parameter to the affected script.  This parameter would probably contain file names preceded by directory-traversal strings.  

ID	Name	Product	Family	Severity
35052	FreeBSD : mantis -- multiple vulnerabilities (29255141-c3df-11dd-a721-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
34250	GLSA-200809-10 : Mantis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
4605	Mantis < 1.1.2 account_prefs_update.php language Parameter Traversal Local File Inclusion	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2008-3333

critical

Tenable Plugins

high

high

high