p PatchFirst

CVE-2026-47142

CVE-2026-47142 · MantisBT: SQL Injection via history_order Configuration Value

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist. An administrator can set this configuration value via the web UI (adm_config_set.php) or the REST API (PATCH /api/rest/config). The injected SQL then executes whenever any user views a bug with history entries. ### Impact - Sensitive data extraction from the entire bugtracker database including user credentials (cookie_string, password hashes), API tokens, and private issue data - With MySQL FILE privilege: full RCE via INTO OUTFILE writing a PHP webshell to the web root - The admin plants the payload once; any authenticated user viewing a bug with history triggers the injection ### Patches - https://github.com/mantisbt/mantisbt/commit/6ad20bea2e01f33c6e4170775ae4d9dbe2c75325 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### Resources - https://mantisbt.org/bugs/view.php?id=37123 ### Credits McCaulay Hudson (@McCaulay) of watchTowr

CVSS 8.5 · High · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mantisbt/mantisbt Packagist

    Versions
    • 2.10.0
    • 2.10.1
    • 2.11.0
    • 2.11.1
    • 2.12.0
    • 2.12.1
    • 2.12.2
    • 2.13.0
    • 2.13.1
    • 2.13.2
    • 2.14.0
    • 2.15.0
    • 2.15.1
    • 2.16.0
    • 2.16.1
    • 2.17.0
    • 2.17.1
    • 2.17.2
    • 2.18.0
    • 2.18.1
    • 2.19.0
    • 2.19.1
    • 2.20.0
    • 2.20.1
    • 2.21.0
    • 2.21.1
    • 2.21.2
    • 2.21.3
    • 2.22.0
    • 2.22.1
    • 2.22.2
    • 2.23.0
    • 2.23.1
    • 2.24.0
    • 2.24.1
    • 2.24.2
    • 2.24.3
    • 2.24.4
    • 2.24.5
    • 2.25.0
    • 2.25.1
    • 2.25.2
    • 2.25.3
    • 2.25.4
    • 2.25.5
    • 2.25.6
    • 2.25.7
    • 2.25.8
    • 2.26.0
    • 2.26.1
    • 2.26.2
    • 2.26.3
    • 2.26.4
    • 2.27.0
    • 2.27.1
    • 2.27.2
    • 2.27.3
    • 2.28.0
    • 2.28.1
    • 2.28.2
    • 2.28.3
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.6.0
    • 2.7.0
    • 2.7.1
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 2.9.1
    Affected ranges
    • ECOSYSTEM: < 2.28.4

    Update to 2.28.4

Original sources

Check your server →