Mediawiki - Cargo SQL Injection Vulnerability
CVE-2024-47849
9.8CRITICAL
Summary
A vulnerability exists in the Wikimedia Foundation's MediaWiki Cargo extension, characterized by improper neutralization of special elements used in SQL commands, leading to SQL Injection. This issue specifically impacts Cargo versions from 3.6.X prior to 3.6.1. Exploiting this vulnerability could allow an attacker to manipulate SQL queries, potentially compromising the integrity of the database and exposing sensitive data.
Affected Version(s)
Mediawiki - Cargo 3.6.x < 3.6.1
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Yaron_Koren
BlankEclair