Incorrect Comparison Affecting mantisbt/mantisbt package, versions <2.27.2

mantisbt/mantisbt is a mantis bug tracker.

Affected versions of this package are vulnerable to Incorrect Comparison via the authentication_api.php process. An attacker can gain unauthorized access to user accounts by exploiting PHP type juggling in the authentication logic, allowing login with any password that produces a hash matching a specific pattern. This is only exploitable if the instance is configured to use the MD5 login method and the user's password hash matches the regex ^0+[Ee][0-9]+$.

This vulnerability can be mitigated by checking the database for accounts with vulnerable password hashes and changing those users' passwords.

• GitHub Commit
• Vulnerable Code