CVE-2014-9573: SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2...

Security readout for executives and security teams

MantisBT versions before 1.2.19 and 1.3.x before 1.3.0-beta.2 have a SQL injection issue in the user management page. The source states exploitation requires a remote administrator with FILE privileges, so exposure is concentrated around privileged accounts and database configuration rather than anonymous internet traffic. Organizations running affected MantisBT releases are exposed if administrative users can access the management page and the relevant FILE privilege condition exists. Public exposure of the MantisBT admin surface increases operational risk, but the source bundle does not identify anonymous exploitation. Treat this as a targeted administrative-risk issue. Prioritize upgrades for internet-facing or sensitive MantisBT deployments, especially where privileged accounts or database permissions are broadly assigned. No active exploitation is evidenced in the supplied sources. Mitigation focus: Upgrade MantisBT to 1.2.19, 1.3.0-beta.2, or a later fixed release.; Review vendor issue records and commits before applying any backported patch.; Restrict access to MantisBT administrative pages to trusted networks or administrators..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.