This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: MantisBT allows arbitrary password resets via an empty `confirm_hash` in `verify.php`. ๐ **Consequences**: Attackers gain **unauthenticated admin access** and can hijack any user account.โฆ
๐ข **Vendor**: MantisBT Team. ๐ฆ **Product**: MantisBT (Open-source bug tracker). ๐ **Affected Versions**: **2.3.0 and earlier**. โ ๏ธ **Note**: Newer versions may be patched, but this specific range is vulnerable.
๐ **Threshold**: **LOW**. ๐ซ **Auth Required**: **None**. ๐ **Config**: Simple HTTP request to `verify.php`. โก **Ease**: Extremely easy to exploit via a single crafted request with an empty hash. No complex setup needed.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exp**: **YES**. ๐งช **PoC Available**: Yes, via Nuclei templates and security advisories (e.g., hyp3rlinx). ๐ **Wild Exploitation**: High risk due to simplicity.โฆ
๐ **Self-Check**: Scan for `verify.php` endpoints. ๐งช **Test**: Send request with `confirm_hash=` (empty). โ ๏ธ **Indicator**: If password reset succeeds or no error occurs, you are vulnerable.โฆ
๐ง **Official Fix**: **YES**. ๐ **Date**: Advisory published April 16, 2017. ๐ **Action**: Upgrade to a version **newer than 2.3.0**. โ **Status**: The issue was confirmed and addressed by the MantisBT team.
Q9What if no patch? (Workaround)
๐ง **Workaround**: If patching is delayed, **disable password reset functionality** via configuration. ๐ **Access Control**: Restrict access to `verify.php` via WAF or firewall rules.โฆ
๐ฅ **Urgency**: **HIGH**. ๐จ **Priority**: **Critical**. โก **Reason**: Unauthenticated admin access is a severe threat. ๐ **Action**: Patch **immediately**. Do not wait.โฆ