PT-2025-45671 · Packagist · Mantisbt/Mantisbt

Published

2025-11-03

·

Updated

2025-11-03

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Due to an incorrect use of loose (==) instead of strict (===) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.
[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authentication api.php#L782

Impact

On MantisBT instances configured to use the MD5 login method, user accounts having a password hash evaluating to zero (i.e. matching regex ^0+[Ee][0-9]+$) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a hash evaluating to zero, for example comito5 (0e579603064547166083907005281618).
No password bruteforcing for individual users is needed, thus $g max failed login count does not protect against the attack.

Patches

Workarounds

Check the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL:
sql
SELECT username, email FROM mantis user table WHERE password REGEXP '^0+[Ee][0-9]+$'

References

Credits

Thanks to Harry Sintonen / Reversec for discovering and reporting the issue.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-305CWE-697

Related Identifiers

GHSA-4V8W-GG5J-PH37

Affected Products

Mantisbt/Mantisbt