Tilesheets MediaWiki Extension SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Tilesheets MediaWiki extension, specifically in versions greater than 5.0.1 and prior to 5.0.3. The issue arises from a missing backtick in a SQL query, which allows users to inject and potentially execute malicious SQL code. This vulnerability has not been fixed.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to execute arbitrary SQL code, potentially leading to unauthorized data access or modification.

Reproduction

To reproduce this vulnerability, send a request to the 'Special:SheetManager' page with a 'mod' parameter containing a payload that includes a backtick followed by SQL injection syntax, such as 'Test` = 1#'. This will trigger a SQL syntax error that reveals the injection point, demonstrating that SQL injection is possible.

Remediation

Users are advised to update to Tilesheets version 5.0.3 or later.