cve/2017/CVE-2017-7615.md

CVE-2017-7615

Description

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

POC

Reference

• http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
• http://packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html
• https://www.exploit-db.com/exploits/41890/

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/20142995/sectool
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/Ostorlab/KEV
• https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
• https://github.com/SexyBeast233/SecBooks
• https://github.com/merlinepedra/nuclei-templates
• https://github.com/merlinepedra25/nuclei-templates
• https://github.com/sobinge/nuclei-templates