Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote...

Vulnerability Description

Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (9) enum_bug_group function in plugins/MantisGraph/core/graph_api.php; (10) bug_graph_bycategory.php or (11) bug_graph_bystatus.php in plugins/MantisGraph/pages/; or (12) proj_doc_page.php, related to use of the db_query function, a different vulnerability than CVE-2014-1608.

References

• http://www.securityfocus.com/bid/65461
• https://bugzilla.redhat.com/show_bug.cgi?id=1063111
• http://www.ocert.org/advisories/ocert-2014-001.html
• http://www.debian.org/security/2014/dsa-3030
• https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f
• http://secunia.com/advisories/61432
• http://www.mantisbt.org/bugs/view.php?id=16880