{"generator":"GNU social 2.0.2-dev","title":"Conversation","totalItems":1,"items":[{"actor":{"id":"https:\/\/infosec.exchange\/users\/harrysintonen","displayName":"Harry Sintonen","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/185551-original-tmp20250911082449.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/185551-96-20250911120558.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/185551-48-20250911120558.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/185551-24-20250911120558.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"185551"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/185551-96-20250911120558.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Infosec consultant at REV\u018e\u042fSEC https:\/\/reversec.com - Coding, Research + various other interests","url":"https:\/\/infosec.exchange\/@harrysintonen","portablecontacts_net":{"preferredUsername":"harrysintonen","displayName":"Harry Sintonen","note":"Infosec consultant at REV\u018e\u042fSEC https:\/\/reversec.com - Coding, Research + various other interests"}},"content":"<p>Several months ago, I found a <a href=\"https:\/\/infosec.exchange\/tags\/vulnerability\" class=\"mention hashtag\" rel=\"tag\">#vulnerability<\/a> from <a href=\"https:\/\/infosec.exchange\/tags\/MantisBT\" class=\"mention hashtag\" rel=\"tag\">#MantisBT<\/a> - Authentication bypass for some passwords due to PHP type juggling (CVE-2025-47776).<\/p><p>Any account that has a password that results in a hash that matches ^0+[Ee][0-9]+$ can be logged in with a password that matches that regex as well. For example, password comito5 can be used to log in to the affected accounts and thus gain unauthorised access.<\/p><p>The root cause of this bug is the incorrect use of == to match the password hash:<\/p><p>if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) == $t_password )<\/p><p>The fix is to use === for the comparison.<\/p><p>This vulnerability has existed in MantisBT ever since hashed password support was added (read: decades). MantisBT 2.27.2 and later include a fix to this vulnerability. <a href=\"https:\/\/mantisbt.org\/download.php\" rel=\"nofollow\">https:\/\/mantisbt.org\/download.php<\/a><\/p><p><a href=\"https:\/\/infosec.exchange\/tags\/CVE_2025_47776\" class=\"mention hashtag\" rel=\"tag\">#CVE_2025_47776<\/a> <a href=\"https:\/\/infosec.exchange\/tags\/infosec\" class=\"mention hashtag\" rel=\"tag\">#infosec<\/a> <a href=\"https:\/\/infosec.exchange\/tags\/cybersecurity\" class=\"mention hashtag\" rel=\"tag\">#cybersecurity<\/a><\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-13:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/infosec.exchange\/users\/harrysintonen\/statuses\/115474480965441636","object":{"id":"https:\/\/infosec.exchange\/users\/harrysintonen\/statuses\/115474480965441636","objectType":"note","content":"<p>Several months ago, I found a <a href=\"https:\/\/infosec.exchange\/tags\/vulnerability\" class=\"mention hashtag\" rel=\"tag\">#vulnerability<\/a> from <a href=\"https:\/\/infosec.exchange\/tags\/MantisBT\" class=\"mention hashtag\" rel=\"tag\">#MantisBT<\/a> - Authentication bypass for some passwords due to PHP type juggling (CVE-2025-47776).<\/p><p>Any account that has a password that results in a hash that matches ^0+[Ee][0-9]+$ can be logged in with a password that matches that regex as well. For example, password comito5 can be used to log in to the affected accounts and thus gain unauthorised access.<\/p><p>The root cause of this bug is the incorrect use of == to match the password hash:<\/p><p>if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) == $t_password )<\/p><p>The fix is to use === for the comparison.<\/p><p>This vulnerability has existed in MantisBT ever since hashed password support was added (read: decades). MantisBT 2.27.2 and later include a fix to this vulnerability. <a href=\"https:\/\/mantisbt.org\/download.php\" rel=\"nofollow\">https:\/\/mantisbt.org\/download.php<\/a><\/p><p><a href=\"https:\/\/infosec.exchange\/tags\/CVE_2025_47776\" class=\"mention hashtag\" rel=\"tag\">#CVE_2025_47776<\/a> <a href=\"https:\/\/infosec.exchange\/tags\/infosec\" class=\"mention hashtag\" rel=\"tag\">#infosec<\/a> <a href=\"https:\/\/infosec.exchange\/tags\/cybersecurity\" class=\"mention hashtag\" rel=\"tag\">#cybersecurity<\/a><\/p>","url":"https:\/\/infosec.exchange\/@harrysintonen\/115474480965441636","status_net":{"notice_id":null},"tags":[{"objectType":"http:\/\/activityschema.org\/object\/hashtag","displayName":"cybersecurity"},{"objectType":"http:\/\/activityschema.org\/object\/hashtag","displayName":"infosec"},{"objectType":"http:\/\/activityschema.org\/object\/hashtag","displayName":"mantisbt"},{"objectType":"http:\/\/activityschema.org\/object\/hashtag","displayName":"vulnerability"}]},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-11-01:objectType=thread:nonce=46cdbd8b7d994417","notice_info":{"local_id":"11430577","source":"ActivityPub"}},"published":"2025-11-01T15:35:20+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/infosec.exchange\/@harrysintonen\/115474480965441636"}],"links":[{"url":"https:\/\/gnusocial.jp\/conversation\/5821520","rel":"alternate","type":"text\/html"}]}