CVE-2018-6382

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP…

published January 30, 2018

CVSS
—
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00526 · 43.7th percentile
Published
2018-01-30T06:00Z
EPSS history
Timeline
  • 30 JAN 06:00Z
    MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP…
    cvelistv5