Listen to this Post
The CVE-2025-XXXX vulnerability in MantisBT stems from an insufficient verification mechanism during a user’s email address change. When a user submits a request to update their profile email within the `/account_page.php` endpoint, the application logic fails to enforce any form of ownership validation for the new address. The typical workflow involves the `account_update.php` script processing the POST request, which directly takes the new email value from the user-submitted form and saves it to the database via a call like user_set_email(), without sending a verification link or confirmation code to the new address. This lack of a challenge-response step means an attacker with access to a user’s session could maliciously alter the associated email to one they control. Consequently, all subsequent system notifications, including sensitive issue updates and password reset links, would be diverted to the attacker’s specified email, leading to information disclosure and potential account takeover, all without the legitimate user’s knowledge.
Platform: MantisBT
Version: <2.27.2
Vulnerability: Email Hijacking
Severity: Moderate
date: 2025-11-01
Prediction: Patch Available
What Undercode Say:
curl -X POST 'http://mantisbt-host/account_update.php' \ -d '[email protected]'
// account_update.php (Vulnerable code snippet) $f_email = gpc_get_string( 'email' ); user_set_email( $t_user_id, $f_email ); // No prior verification
How Exploit:
1. Acquire user session.
2. Navigate to account page.
3. Change email address.
4. Receive all notifications.
Protection from this CVE
Update to version 2.27.2. Implement email verification workflow before applying changes.
Impact:
Information disclosure via notification hijacking. Account takeover facilitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
