CVE-2008-4687

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute...

9.0 HighPublic exploit

CVE-2008-4687 is a high vulnerability (CVSS 9.0) in Mantis, published October 22, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 67.5%, the 99th percentile. No source names a fixed version.

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.

Exploit likelihood

67.5%Down 17.8 points since Feb 4, 2022

What each source reports

NVD Score used 9.0

Record: CVE-2008-4687
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-4687
Updated: 2026-11-02

EUVDEUVD-2008-4667 No score

Record: EUVD-2008-4667
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hv4w-qf5w-5wqc No score

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute...

Record: GHSA-hv4w-qf5w-5wqc
Weakness: CWE-94
Updated: 2026-11-02

Affected products

mantis

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Mantis Bug Tracker 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)	2018-05-10
Exploit-DB	Mantis Bug Tracker 1.1.3 - Remote Code Execution	2008-10-16
Metasploit	Mantis manage_proj_page PHP Code Execution	2008-10-16
PoC in GitHub	nmurilo/CVE-2008-4687-exploit	2020-05-30
PoC in GitHub	twisted007/mantis_rce	2021-09-25

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, PoC in GitHub

References

Show 9 moreShow less