MantisBT Default Admin Login

ID: mantisbt-default-credential

Severity: high

Author: For3stCo1d,YashVardhanTripathi

Tags: mantisbt,default-login

Description

A MantisBT default admin login was discovered.

YAML Source

id: mantisbt-default-credential

info:
  name: MantisBT Default Admin Login
  author: For3stCo1d,YashVardhanTripathi
  severity: high
  description: A MantisBT default admin login was discovered.
  reference:
    - https://mantisbt.org/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
    cpe: cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    shodan-query: title:"MantisBT"
    product: mantisbt
    vendor: mantisbt
  tags: mantisbt,default-login

http:
  - raw:
      - |
        GET /login_password_page.php HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /login_password_page.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: MANTIS_secure_session=1; PHPSESSID={{session}}
        Content-Type: application/x-www-form-urlencoded

        return=index.php&username={{username}}
      - |
        POST /login_password_page.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: MANTIS_secure_session=1; PHPSESSID={{session}}

        return=index.php&username={{username}}&password={{password}}&secure_session=on
      - |
        GET /my_view_page.php HTTP/1.1
        Host: {{Hostname}}

    attack: pitchfork
    payloads:
      username:
        - administrator
      password:
        - root

    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - "View Issues"
          - "Change Log"
        condition: and

      - type: regex
        part: header_3
        regex:
          - "Location: .*?/login_cookie_test.php\\?return=account_page.php"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: session
        internal: true
        group: 1
        part: header
        regex:
          - "PHPSESSID=([a-zA-Z0-9]+);"
# digest: 4b0a00483046022100889b98fd6b439f6314cc397d15bb5e25fa7751784c758bb53b17939cd6e0479d022100ce5f5ed5e11b2c8564f326d39ea620d878cb423f5762ed98d1fc31590ed29d4b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/default-logins/mantisbt/mantisbt-default-credential.yaml"

View on Github