Vulnerability record · CVE-2008-4687 · published 22 October 2008
CVE-2008-4687: Mantis manage_proj_page.php sort parameter code injection
Mantis · Mantis
Mantis before 1.1.4 passes the sort parameter from manage_proj_page.php into create_function within the multi_sort function in core/utility_api.php, allowing PHP sequences in that parameter to be executed. This is a code injection flaw that lets an authenticated user run arbitrary PHP code on the server.
Description
manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.
AV:N/AC:L/Au:S/C:C/I:C/A:C
Automated analysis
high priorityRemote authenticated code execution with complete impact and very high EPSS, though exploitation requires a valid account and no KEV listing exists.
What it is
Mantis before 1.1.4 passes the sort parameter from manage_proj_page.php into create_function within the multi_sort function in core/utility_api.php, allowing PHP sequences in that parameter to be executed. This is a code injection flaw that lets an authenticated user run arbitrary PHP code on the server.
Impact
An attacker with a valid Mantis account can execute arbitrary code with the web server's privileges, leading to full compromise of confidentiality, integrity and availability of the application and host.
Attack surface
Reached remotely over the network through manage_proj_page.php; the CVSS vector AV:N/AC:L/Au:S indicates no special conditions beyond a single authenticated account, and no user interaction is required.
Exploitation
No CISA KEV listing and no ransomware associations are recorded, but public exploit code exists in Exploit-DB (6768, 44611) and EPSS is very high at 0.67453 (99.27th percentile), indicating elevated likelihood of exploitation.
What to do
- Upgrade Mantis to 1.1.4 or later, which removes the unsafe create_function usage in multi_sort.
- If immediate upgrade is not possible, restrict access to manage_proj_page.php to trusted administrators only.
- Apply the vendor patch referenced in the Mantis changelog and bug 9704.
- Deploy the Gentoo GLSA-200812-07 update if running Mantis from Gentoo packages.
- Review accounts with project management privileges and remove unnecessary ones.
Detection
- Inspect web server and application logs for requests to manage_proj_page.php with sort parameters containing PHP function or code-like strings.
- Monitor for unexpected PHP process execution or outbound connections originating from the Mantis web server.
- Audit file integrity on the Mantis installation and web root for newly written or modified PHP files.
- Alert on repeated or anomalous access to manage_proj_page.php from authenticated sessions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-4687 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-4687), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
