CVE-2014-2238 in MantisBT
Summary
by MITRE
SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/07/2026
The vulnerability identified as CVE-2014-2238 represents a critical sql injection flaw within the MantisBT issue tracking system affecting versions 1.2.13 through 1.2.16. This vulnerability specifically targets the manage configuration page functionality known as adm_config_report.php which serves as an administrative interface for system configuration management. The flaw arises from insufficient input validation and sanitization of user-supplied data within the filter_config_id parameter, creating an avenue for malicious exploitation by authenticated administrators who possess administrative privileges.
The technical implementation of this vulnerability stems from improper handling of user input within the application's database query construction process. When the filter_config_id parameter is processed through the adm_config_report.php page, the application fails to properly escape or validate the input before incorporating it into sql statements. This creates a classic sql injection vector that allows an attacker to manipulate the intended database queries and execute arbitrary sql commands. The vulnerability is classified under CWE-89 sql injection as it enables unauthorized data manipulation and potential system compromise through malicious sql payloads. The attack requires only authenticated administrative access, making it particularly dangerous as it bypasses typical network-level security controls.
The operational impact of this vulnerability extends beyond simple data manipulation to potentially enable full system compromise and unauthorized access to sensitive information. An attacker with administrative privileges can leverage this vulnerability to extract confidential data from the database, modify system configurations, escalate privileges, or even gain access to underlying system resources. The affected MantisBT versions represent a significant portion of the user base that would be vulnerable to this attack vector, particularly in enterprise environments where issue tracking systems contain sensitive project data and user information. This vulnerability directly maps to several ATT&CK tactics including privilege escalation through sql injection and credential access via database exploitation.
Mitigation strategies for CVE-2014-2238 should prioritize immediate patching of affected MantisBT installations to versions 1.2.17 or later where the vulnerability has been addressed through proper input validation and parameterized query implementation. Organizations should implement additional security controls including network segmentation to limit administrative access, regular security audits of administrative interfaces, and monitoring for suspicious database query patterns. The vulnerability demonstrates the critical importance of input validation and proper sql query construction practices, aligning with security best practices outlined in standards such as owasp top 10 and iso 27001. Administrators should also consider implementing web application firewalls to detect and block malicious sql injection attempts, though this represents a secondary defense mechanism rather than a primary solution. Regular security training for administrators and systematic code reviews focusing on sql injection prevention should be implemented to reduce the risk of similar vulnerabilities in custom applications or modified versions of the software.