MantisBT vulnerabilities

CAPTCHA bypass vulnerability in MantisBT before version 1.2.19.

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, allowing remote attackers to obtain database credentials via the install parameter with the value 4.

The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter.

Multiple SQL injection vulnerabilities in MantisBT before version 1.2.18 in view_all_bug_page.php allow remote attackers to execute arbitrary SQL commands via the sort or dir parameter to view_all_set.php.

SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter.

Multiple SQL injection vulnerabilities in MantisBT before version 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in various API functions.

MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default installations because self-registration is enabled by default.

Mantis Bug Tracker (MantisBT) versions 2.27.1 and below use loose (==) instead of strict (===) comparison in authentication code. PHP type juggling causes certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using MD5 login allow an attacker who knows the victim's username and has access to an account with a password hash evaluating to zero to log in without knowing the victim's password, using any other password with a hash also evaluating to zero. Fixed in 2.27.2.

Mantis Bug Tracker (MantisBT) prior to version 2.28.2 contains a vulnerability that allows code execution by an attacker. By using the show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can upload a crafted XHTML attachment referencing a JavaScript attachment.

In Mantis Bug Tracker (MantisBT) versions 1.3.0 through 2.28.1, an unescaped Project Name allows an attacker with manager or administrator privileges to inject HTML on the Move Attachments admin page. This vulnerability is fixed in version 2.28.2.

MantisBT versions 2.11.0 through 2.28.1 contain a stored XSS vulnerability due to incorrect escaping of a saved filter's owner. An attacker can inject arbitrary HTML if the option to show real user names is enabled.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and below have a vulnerability due to improper escaping of the redirection page from the Referer header, allowing HTML injection. On specific server configurations, this could lead to cache poisoning and cross-site scripting.

Vulnerability in Mantis Bug Tracker (MantisBT) versions 2.28.1 and below. An attacker can bypass Content Security Policy script-src directive by uploading a crafted attachment that, when accessed via file_download.php, is interpreted as JavaScript, enabling script execution.

Mantis Bug Tracker (MantisBT) versions 2.11.0 through 2.28.1 allow an authenticated user to inject arbitrary HTML by updating their font family. The XSS payload is reflected on every MantisBT page.

Mantis Bug Tracker (MantisBT) up to version 2.28.1 is vulnerable to HTML and JavaScript injection in a textarea custom field on the Update Issue page. An authenticated attacker with low privileges can inject code that executes in the administrator's browser, leading to session theft and account takeover.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This is fixed in version 2.28.2.

Mantis Bug Tracker (MantisBT) versions up to 2.28.1 allow an authenticated user to upload attachments to private issues they are not authorized to access.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier allow a user to list and download their own attachments from an issue created by another user even after it becomes private, bypassing read access revocation. The confidentiality impact is minimal as only the user's own attachments are accessible. This is fixed in version 2.82.2.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier are vulnerable to authorization bypass via the private issue monitoring feature. A user with project-level access can add themselves as a monitor for a private issue they cannot access by sending a crafted POST request to bug_monitor_add.php. Despite an Access Denied error, the monitor relationship is created, leading to email notifications that disclose private issue metadata and content. This is fixed in version 2.28.2.

In Mantis Bug Tracker (MantisBT) versions 2.28.1 and prior, a privilege escalation vulnerability exists. Users with manage_project_threshold access level (manager by default) can grant project-level administrator access to any user in any project they manage. The issue has been fixed in version 2.28.2.

Mantis Bug Tracker versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user to create a global profile by tampering with the user_id parameter, bypassing required permissions.

Mantis Bug Tracker (MantisBT) versions 2.27.1 and below have insufficient access-level checks. Any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve column configuration from a private project they cannot access. The issue is fixed in version 2.27.2.

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters) due to a lack of server-side validation of note length. Once such a note is added, the activity stream UI fails to render; therefore, new notes cannot be displayed, effectively breaking all future collaboration on the issue. This issue is fixed in version 2.27.2.