| Package | Affected versions | Patched versions |
|---|---|---|
| mantisbt | = 0.18.0= 0.19.0= 0.19.0a1= 0.19.0a2= 0.19.1= 0.19.2= 0.19.3= 0.19.4= 0.19.5= 1.0.0= 1.0.0a1= 1.0.0a2= 1.0.0a3= 1.0.1= 1.0.2= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.0.9= 1.1.0= 1.1.1= 1.1.2= 1.1.3= 1.1.4= 1.1.5= 1.1.6= 1.1.7= 1.1.8= 1.1.9= 1.2.0= 1.2.0a1= 1.2.0a2= 1.2.1= 1.2.10= 1.2.11= 1.2.12= 1.2.13= 1.2.14= 1.2.15= 1.2.16= 1.2.2= 1.2.3= 1.2.4= 1.2.5= 1.2.6= 1.2.7= 1.2.8= 1.2.9≤ 1.2.17 |
SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free