CVEvulnerability

CVE-2005-2556

7.5 HIGH Published 2005-08-24 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-08-24
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type variable and monitoring the speed of responses, as identified by bug#0005956.

Affected configurations

• mantis mantis 0.19.0 • mantis mantis 0.19.0 rc1 • mantis mantis 0.19.0a1 • mantis mantis 0.19.0a2 • mantis mantis 0.19.1 • mantis mantis 0.19.2 • mantis mantis 1.0.0a1 • mantis mantis 1.0.0a2 • mantis mantis 1.0.0a3

References