CVE Request: DB credentials disclosure in MantisBT's unattended upgrade script

[Damien Regad <dregad () mantisbt org>]

Greetings,

Kindly assign a CVE ID for the following issue.


Description:

The unattended upgrade script retrieved DB connection settings from POST 
parameters, allowing an attacker to get the script to connect to their 
host with the current DB config credentials.

As per installation instructions [1], the admin/ directory (which 
contains the vulnerable script) should be deleted in a Production instance.

Affected versions:
>= 1.1.0a3, <= 1.2.17

Fixed in versions:
1.2.18 (not yet released)

Patch:
See Github [2]

Credit:
Issue was reported by Mathias Karlsson (http://mathiaskarlsson.me) as 
part of Offensive Security's bug bounty program [3].
It was fixed by Paul Richards.

References:
Further details available in our issue tracker [4]


[1] 
https://mantisbt.org/docs/master-1.2.x/en/administration_guide/admin.install.postcommon.html
[2] http://github.com/mantisbt/mantisbt/commit/0826cef8
[3] http://www.offensive-security.com/bug-bounty-program/
[4] http://www.mantisbt.org/bugs/view.php?id=17877