CVE-2014-9573

Name	CVE-2014-9573
Description	SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	780875

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mantis	source	squeeze	(unfixed)	end-of-life
mantis	source	(unstable)	(unfixed)			780875

Notes

[wheezy] - mantis <no-dsa> (Minor issue)
[squeeze] - mantis <end-of-life> (Unsupported in squeeze-lts)
Upstream patch: http://github.com/mantisbt/mantisbt/commit/69c2d28d (1.2.x)
https://www.mantisbt.org/bugs/view.php?id=17940