CVE-2017-7615 — AI Deep Analysis Summary

🚨 **Essence**: MantisBT allows arbitrary password resets via an empty `confirm_hash` in `verify.php`. 📉 **Consequences**: Attackers gain **unauthenticated admin access** and can hijack any user account.…

🛡️ **Root Cause**: **Authorization Bypass** / **Broken Access Control**. The system fails to validate the `confirm_hash` parameter.…

🏢 **Vendor**: MantisBT Team. 📦 **Product**: MantisBT (Open-source bug tracker). 📅 **Affected Versions**: **2.3.0 and earlier**. ⚠️ **Note**: Newer versions may be patched, but this specific range is vulnerable.

👑 **Privileges**: **Administrator Access**. 🔄 **Action**: Reset **any user's password** (including admins). 🔓 **Access**: **Unauthenticated** entry.…

📉 **Threshold**: **LOW**. 🚫 **Auth Required**: **None**. 🌐 **Config**: Simple HTTP request to `verify.php`. ⚡ **Ease**: Extremely easy to exploit via a single crafted request with an empty hash. No complex setup needed.

📜 **Public Exp**: **YES**. 🧪 **PoC Available**: Yes, via Nuclei templates and security advisories (e.g., hyp3rlinx). 🌍 **Wild Exploitation**: High risk due to simplicity.…

🔍 **Self-Check**: Scan for `verify.php` endpoints. 🧪 **Test**: Send request with `confirm_hash=` (empty). ⚠️ **Indicator**: If password reset succeeds or no error occurs, you are vulnerable.…

🔧 **Official Fix**: **YES**. 📅 **Date**: Advisory published April 16, 2017. 🆙 **Action**: Upgrade to a version **newer than 2.3.0**. ✅ **Status**: The issue was confirmed and addressed by the MantisBT team.

🚧 **Workaround**: If patching is delayed, **disable password reset functionality** via configuration. 🛑 **Access Control**: Restrict access to `verify.php` via WAF or firewall rules.…

🔥 **Urgency**: **HIGH**. 🚨 **Priority**: **Critical**. ⚡ **Reason**: Unauthenticated admin access is a severe threat. 🏃 **Action**: Patch **immediately**. Do not wait.…