CVE-2019-15715

This exploit chains CVE-2017-7615 (password reset) and CVE-2019-15715 (command injection) to achieve unauthenticated RCE in Mantis Bug Tracker 2.3.0. It resets the admin password, logs in, configures malicious settings, and triggers a reverse shell.

This repository contains a functional Python exploit for CVE-2019-15715, targeting Mantis Bug Tracker versions <=2.22.0. The exploit leverages unauthenticated remote code execution by manipulating configuration options to inject a reverse shell payload.