CVE-2017-7615

This exploit leverages a pre-authentication password reset vulnerability in Mantis Bug Tracker by bypassing the confirm_hash check in verify.php, allowing an attacker to reset any user's password by supplying an empty confirm_hash value.

This exploit chains CVE-2017-7615 (password reset) and CVE-2019-15715 (command injection) to achieve unauthenticated RCE in Mantis Bug Tracker. It resets the admin password, logs in, configures malicious settings, and triggers a reverse shell.

This Metasploit module exploits an unauthenticated password reset vulnerability in MantisBT versions before 1.3.10, 2.2.4, and 2.3.1. It allows an attacker to reset the password of any user by manipulating the verification process and setting a new password.