CVEs-PoC/2014/CVE-2014-7146.md

CVE-2014-7146

Description

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.

POC

Reference

• http://www.mantisbt.org/bugs/view.php?id=17725
• http://www.mantisbt.org/bugs/view.php?id=17725

Github

No PoCs found on GitHub currently.