EDB-49340

PoC

Mantis Bug Tracker 2.24.3 - 'access' SQL Injection

view exploit source exploit_dbtype webappsauthor EthicalHCOPpublished 2021-01-04catalog exploit_db

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2020-28413US	medium6.5	4.78% (92nd)	Exploit	2020-12-30
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.