{"id":"GHSA-mw6p-33vw-46cc","aliases":["CVE-2026-47142"],"title":"MantisBT: SQL Injection via history_order Configuration Value","description":"MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist.\n\nAn administrator can set this configuration value via the web UI (adm_config_set.php) or the REST API (PATCH /api/rest/config). The injected SQL then executes whenever any user views a bug with history entries.\n\n### Impact\n- Sensitive data extraction from the entire bugtracker database including user credentials (cookie_string, password hashes), API tokens, and private issue data\n- With MySQL FILE privilege: full RCE via INTO OUTFILE writing a PHP webshell to the web root\n- The admin plants the payload once; any authenticated user viewing a bug with history triggers the injection\n\n### Patches\n- https://github.com/mantisbt/mantisbt/commit/6ad20bea2e01f33c6e4170775ae4d9dbe2c75325\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### Resources\n- https://mantisbt.org/bugs/view.php?id=37123\n\n### Credits\nMcCaulay Hudson (@McCaulay) of watchTowr","severity":"high","score":8.5,"published":"2026-07-15T16:38:22.000Z","modified":"2026-07-15T16:56:40.831Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"mantisbt/mantisbt","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.28.4"}],"type":"ECOSYSTEM"}],"versions":["2.10.0","2.10.1","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.14.0","2.15.0","2.15.1","2.16.0","2.16.1","2.17.0","2.17.1","2.17.2","2.18.0","2.18.1","2.19.0","2.19.1","2.20.0","2.20.1","2.21.0","2.21.1","2.21.2","2.21.3","2.22.0","2.22.1","2.22.2","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.24.4","2.24.5","2.25.0","2.25.1","2.25.2","2.25.3","2.25.4","2.25.5","2.25.6","2.25.7","2.25.8","2.26.0","2.26.1","2.26.2","2.26.3","2.26.4","2.27.0","2.27.1","2.27.2","2.27.3","2.28.0","2.28.1","2.28.2","2.28.3","2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","2.4.1","2.4.2","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1"],"fixed":["2.28.4"]}],"references":["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mw6p-33vw-46cc","https://github.com/mantisbt/mantisbt/commit/6ad20bea2e01f33c6e4170775ae4d9dbe2c75325","https://github.com/mantisbt/mantisbt","https://mantisbt.org/bugs/view.php?id=37123"],"sources":[{"name":"OSV","id":"GHSA-mw6p-33vw-46cc","modified":"2026-07-15T16:56:40.831437Z","url":"https://osv.dev/vulnerability/GHSA-mw6p-33vw-46cc"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.5}]}