MantisBT SQL Injection via mc_project_get_users function

published 2020-12-30 5 y ago modified 2026-06-17 4 mo ago also GHSA-49w9-82cj-xr48 , EUVD-2020-20872

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 4.8%; EPSS 4.8% chance of exploitation in 30 days, percentile 91%
public exploits: 1; Exploit-DB

In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.

Patch / fix

fixed in 1 links 1

packagist mantisbt/mantisbt 2.24.4

github.com/mantisbt/mantisbt@3e37b40 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-28413 updated 2025-11-21 cvss 9.8

mantis: SQL Injection in the parameter "access" of the mc_project_get_users function through the API SOAP

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2020-12-30 Published
2021-01-04 First public exploit (EDB-49340)

Exploit prediction

4.78% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-49340 Mantis Bug Tracker 2.24.3 - 'access' SQL Injection webapps, 2021-01-04
packetstormsecurity.com http://packetstormsecurity.com/files/160750/Mantis-Bug-Tracker-2.24.3-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	mantisbt/mantisbt	<2.24.4	2.24.4

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

github.com /mantisbt/mantisbt/commit/3e37b4041bf76422541836a424ca71bc4a660247
web
packetstormsecurity.com /files/160750/Mantis-Bug-Tracker-2.24.3-SQL-Injection.html
web, exploit, third-party-advisory
ethicalhcop.medium.com /cve-2020-28413-blind-sql-injection-en-mantis-bug-tracker-2-24-3-api-soap-54238f8e046d
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-28413
advisory
github.com /mantisbt/mantisbt
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary