Which versions of PHP are affected by CVE-2026-47142?

MantisBT bug-tracking systems version 2.28.3 and earlier allow administrators to inject SQL commands through configuration settings, enabling unauthorized access to password hashes, API tokens, and…. A patch is available.

How to fix or mitigate CVE-2026-47142?

Within 24 hours, inventory all MantisBT deployments and identify any running version 2.28.3 or earlier. Within 7 days, upgrade all affected instances to MantisBT 2.28.4, which includes the vendor-released patch for this SQL injection vulnerability. Within 30 days, audit administrator access logs for any suspicious changes to the history_order configuration setting and review database query logs for anomalous patterns consistent with data exfiltration.

PHP CVE-2026-47142

HIGH

SQL Injection (CWE-89)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-mw6p-33vw-46cc

PHP Information Disclosure SQLi

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 17:02 vuln.today

Analysis Generated

Jul 15, 2026 - 17:02 vuln.today

CVE Published

Jul 15, 2026 - 16:38 cve.org

HIGH

DescriptionCVE.org

MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist.

An administrator can set this configuration value via the web UI (adm_config_set.php) or the REST API (PATCH /api/rest/config). The injected SQL then executes whenever any user views a bug with history entries.

Impact

Sensitive data extraction from the entire bugtracker database including user credentials (cookie_string, password hashes), API tokens, and private issue data
With MySQL FILE privilege: full RCE via INTO OUTFILE writing a PHP webshell to the web root
The admin plants the payload once; any authenticated user viewing a bug with history triggers the injection

Patches

https://github.com/mantisbt/mantisbt/commit/6ad20bea2e01f33c6e4170775ae4d9dbe2c75325

Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Resources

https://mantisbt.org/bugs/view.php?id=37123

Credits

McCaulay Hudson (@McCaulay) of watchTowr

AnalysisAI

SQL injection in MantisBT 2.28.3 and earlier (fixed in 2.28.4) lets an administrator poison the history_order configuration value, which core/history_api.php concatenates unsanitized into an ORDER BY clause; the injected SQL then fires whenever any authenticated user views a bug that has history entries. This converts an administrator's config-write into database-wide data theft (password hashes, cookie_strings, API tokens, private issues) and, where the MySQL account holds the FILE privilege, remote code execution via INTO OUTFILE dropping a PHP webshell in the web root. No public exploit identified at time of analysis; reported by McCaulay Hudson of watchTowr and tracked as GitHub advisory GHSA-mw6p-33vw-46cc.