CVE-2014-2238: SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 thr...

Security readout for executives and security teams

CVE-2014-2238 is a SQL injection issue in older MantisBT administration functionality. An authenticated administrator could use a vulnerable configuration report page to run unintended SQL against the application database. The business risk depends on whether legacy MantisBT 1.2.13 through 1.2.16 is still deployed and whether administrator access is tightly controlled. Exposure is likely limited to organizations still running MantisBT 1.2.13 through 1.2.16, especially where the administrative interface is reachable by many users or weakly protected. Non-MantisBT systems and newer versions are not shown as affected in the provided sources. Treat this as a legacy exposure cleanup item unless affected MantisBT versions remain in use. If confirmed, prioritize remediation because database manipulation can affect issue integrity, credentials, or operational records, even though exploitation requires administrator authentication. Mitigation focus: Identify any deployed MantisBT 1.2.13 through 1.2.16 instances.; Check MantisBT vendor advisories and release notes for the supported fix path.; Restrict administrative interface access to trusted networks and accounts..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.