CVE-2014-9572: Improper Access Control in install.php

[Damien Regad <dregad () mantisbt org>]

Greetings,

Please update CVE-2014-9572 with the information below


Description:

The vulnerability exists due to insufficient access restrictions to the 
installation script "/[admin]/install.php" when HTTP GET "install" 
parameter is set to "4". A remote unauthenticated attacker can access 
the installation script and obtain database access credentials, which 
are stored in plain text in hidden form fields.

An attacker can use the following URL to access the page and obtain 
database credentials (login and password) in plaintext:

http://mantis/[admin]/install.php?install=4 [^]

Note, that "[admin]" in the URL is changed by default during 
installation. Therefore, the attacker must know the location of the 
administrative interface in order to perform the attack. However, admin 
panel URL can be bruteforced or predicted in many cases.


Affected versions:
- <= 1.2.19
- <= 1.3.0-beta.1

Fixed in versions:
- 1.2.19 (not yet released)
- 1.3.0-beta.2 (not yet released)

Patch:
See Github [1]

Credit:
This vulnerability was reported [2] by High-Tech Bridge Security 
Research Lab (https://www.htbridge.com/), via advisory ID HTB23243 [3].
The issue was fixed by Damien Regad (MantisBT Developer).

References:
Further details available in our issue tracker [4]

[1] http://github.com/mantisbt/mantisbt/commit/5571bcf9 (1.2.x)
    http://github.com/mantisbt/mantisbt/commit/5e5e5750 (1.3.x)
[2] https://www.mantisbt.org/bugs/view.php?id=17937
[3] https://www.htbridge.com/advisory/HTB23243
[4] https://www.mantisbt.org/bugs/view.php?id=17939