CVE-2025-54865 in Tilesheets
Summary
by MITRE • 08/05/2025
Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the Tilesheets extension allows users to insert and potentially execute malicious SQL code. This issue has not been fixed.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2025
The vulnerability identified as CVE-2025-54865 resides within the Tilesheets MediaWiki extension, which provides a table lookup parser function designed to retrieve and return specific images based on item queries. This extension enhances MediaWiki's functionality by enabling users to dynamically access media content through structured data lookups, creating a bridge between database records and visual elements within wiki environments. The extension's core purpose is to facilitate content management through automated image retrieval based on predefined criteria, making it an integral component for wikis that rely on structured media presentation.
The technical flaw manifests in the extension's query processing mechanism where a critical missing backtick in SQL query construction creates a vulnerability that allows for SQL injection attacks. This omission occurs during the parsing of user-supplied input parameters within the table lookup function, specifically when constructing database queries to fetch image references. The absence of proper input sanitization and backtick enclosure around dynamic query elements creates an opening for malicious actors to inject arbitrary SQL commands into the system's database layer. This vulnerability directly maps to CWE-89 which identifies improper neutralization of special elements used in SQL commands, and represents a classic SQL injection vulnerability that can be exploited through the extension's parser function.
The operational impact of this vulnerability is significant and multifaceted across multiple attack vectors within the MediaWiki environment. An attacker exploiting this vulnerability could potentially execute unauthorized database operations including but not limited to data exfiltration, unauthorized data modification, privilege escalation, or even complete database compromise. The vulnerability affects any MediaWiki instance running the Tilesheets extension, with the severity increasing based on the privileges of the user account performing the lookup operation. Depending on the database configuration and user permissions, attackers might gain access to sensitive wiki content, user credentials, or system information that could be leveraged for further attacks within the network infrastructure.
The exploitation of this vulnerability aligns with several tactics described in the MITRE ATT&CK framework, particularly within the credential access and persistence categories. Attackers could utilize this vulnerability to extract database credentials or user information, potentially gaining access to administrative accounts within the wiki system. The vulnerability also enables data manipulation attacks that could compromise the integrity of the wiki content, making it a significant concern for organizations relying on MediaWiki for critical documentation or collaborative platforms. Organizations using the Tilesheets extension should immediately implement mitigations including input validation, query parameterization, and access controls to prevent unauthorized database access through this vector.
Mitigation strategies for CVE-2025-54865 should prioritize immediate implementation of proper input sanitization and query parameterization techniques to prevent SQL injection attacks. The extension should be updated to properly escape or sanitize all user-supplied input before incorporating it into database queries, ensuring that all dynamic elements are properly enclosed in backticks or other appropriate delimiters. Organizations should also implement database access controls to limit the privileges of the database user account used by the extension, following the principle of least privilege. Additionally, monitoring and logging mechanisms should be enhanced to detect anomalous database query patterns that might indicate exploitation attempts. The vulnerability represents a critical security risk that requires immediate attention and remediation to prevent potential data breaches or system compromise within MediaWiki environments.