Summary
MantisBT: SQL Injection via history_order Configuration Value
Advisory details
MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist.
An administrator can set this configuration value via the web UI (adm_config_set.php) or the REST API (PATCH /api/rest/config). The injected SQL then executes whenever any user views a bug with history entries.
Impact
- Sensitive data extraction from the entire bugtracker database including user credentials (cookie_string, password hashes), API tokens, and private issue data
- With MySQL FILE privilege: full RCE via INTO OUTFILE writing a PHP webshell to the web root
- The admin plants the payload once; any authenticated user viewing a bug with history triggers the injection
Patches
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Resources
Credits
McCaulay Hudson (@McCaulay) of watchTowr
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-72807
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
- CRITICALCVE-2026-72811
SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle
- CRITICALCVE-2026-71867
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- CRITICALCVE-2026-71866
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
- HIGHCVE-2026-59834
SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
- MEDIUMCVE-2026-55855
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets