Account takeover via loose MD5 hash comparison

Authentication bypass in MantisBT before 2.27.2 allows remote attackers to access a victim's account through the web login. The auth_does_password_match function uses PHP's loose equality operator to compare an attacker-supplied password hash with the stored MD5 hash, so scientific-notation hashes that both evaluate to zero compare equal. The instance must use MD5 login, the attacker must know the username, and both hashes must evaluate to zero; exploitation grants access to the victim's account.