Listen to this Post
The vulnerability exploits PHP’s type juggling during authentication. When comparing MD5 password hashes, the code uses loose comparison (==) instead of strict (===). In PHP, a string starting with ‘0e’ followed by digits is interpreted as scientific notation. If both the stored hash and the provided hash are strings that evaluate to the number zero (e.g., ‘0e123’ == 0, ‘0e456’ == 0), the loose comparison returns true. Consequently, an attacker can log in to any account with a zero-evaluating MD5 hash by providing any other password that also generates a zero-evaluating hash, bypassing authentication without knowing the actual password.
Platform: MantisBT
Version: <2.27.2
Vulnerability : Authentication Bypass
Severity: Critical
date: 2024
Prediction: 2024-10-15
What Undercode Say:
`echo -n “comito5” | md5sum`
`SELECT username FROM mantis_user_table WHERE password REGEXP ‘^0+[bash][0-9]+$’;`
How Exploit:
Attacker identifies target username.
Attacker uses known ‘magic’ password.
Password hash evaluates to zero.
Loose comparison matches any zero hash.
Authentication is bypassed successfully.
Protection from this CVE
Update to version 2.27.2.
Replace loose with strict comparisons.
Audit database for vulnerable hashes.
Change identified user passwords.
Impact:
Full authentication bypass.
Unauthorized access to accounts.
No brute-force protection.
Compromise of user data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
