[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <7a824313c433c54a212afb25498e8556581@guerrillamail.com>
Date: Sun, 16 Apr 2017 13:08:27 +0000
From: <7b4xrw+5q6jtt69cnwlw@...rrillamail.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: MantisBT - Full admin access vulnerability
A vulnerability exists in MantisBT where any users password can be reset:
Visiting /verify.php?id=XXX&confirm_hash=
where XXX is the userid of the user. id=1 is the default 'administrator' account if it still exists.
On a unpatched instance of mantisBT, this will provide a form to enter a new password for a user.
This works on any enabled account (including users with admin access) - providing an anonymous user with admin access to the system
The issue can be resolved by checking the value of $t_token_confirm_hash is not null in verify.php
i.e. changing the code to read:
if( $f_confirm_hash !== $t_token_confirm_hash || null === $t_token_confirm_hash ) {
trigger_error( ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID, ERROR );
}
----
Sent using Guerrillamail.com
Block or report abuse: https://www.guerrillamail.com//abuse/?a=TlJnSB4FQKEHgRqt0HIWYQDUA8WA19lHxqhOMtz5Bg%3D%3D
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
