CVE-2025-32956

ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix (namespace name, which is the current namespace you are renaming) with an injection payload. This issue has been patched in commit f504ed8. A workaround for this vulnerability involves setting `$wgManageWiki['namespaces'] = false;`.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/miraheze/ManageWiki/commit/f504ed8eeb59b57ebb90f93cd44f23da4c5bc4c9	Patch
https://github.com/miraheze/ManageWiki/security/advisories/GHSA-gg42-cv66-f5x7	Vendor Advisory Mitigation
https://www.vicarius.io/vsociety/posts/cve-2025-32956-detect-mediawiki-vulnerability	Exploit Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-32956-mitigate-mediawiki-vulnerability	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:miraheze:managewiki:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-21 21:15

Updated : 2025-09-19 15:47

NVD link : CVE-2025-32956

Mitre link : CVE-2025-32956

CVE.ORG link : CVE-2025-32956

JSON object : View

Products Affected

miraheze

managewiki

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-32956", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2025-04-21T21:15:20.647", "references": [{"url": "https://github.com/miraheze/ManageWiki/commit/f504ed8eeb59b57ebb90f93cd44f23da4c5bc4c9", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/miraheze/ManageWiki/security/advisories/GHSA-gg42-cv66-f5x7", "tags": ["Vendor Advisory", "Mitigation"], "source": "[email protected]"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-32956-detect-mediawiki-vulnerability", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-32956-mitigate-mediawiki-vulnerability", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix (namespace name, which is the current namespace you are renaming) with an injection payload. This issue has been patched in commit f504ed8. A workaround for this vulnerability involves setting `$wgManageWiki['namespaces'] = false;`."}, {"lang": "es", "value": "ManageWiki es una extensi\u00f3n de MediaWiki que permite a los usuarios administrar wikis. Las versiones anteriores a el commit f504ed8 son vulnerables a la inyecci\u00f3n de SQL al renombrar un espacio de nombres en Special:ManageWiki/namespaces al usar un prefijo de p\u00e1gina (nombre del espacio de nombres, que corresponde al espacio de nombres actual que se est\u00e1 renombrando) con un payload de inyecci\u00f3n. Este problema se ha corregido en el commit f504ed8. Un workaround para esta vulnerabilidad consiste en configurar `$wgManageWiki['namespaces'] = false;`."}], "lastModified": "2025-09-19T15:47:40.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:miraheze:managewiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D77361B-ADBA-4AAE-B034-E809C4108ADA", "versionEndExcluding": "2025-04-20"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}