Mediawiki - Cargo SQL Injection Vulnerability

CVE-2024-47849

What is CVE-2024-47849?

A vulnerability exists in the Wikimedia Foundation's MediaWiki Cargo extension, characterized by improper neutralization of special elements used in SQL commands, leading to SQL Injection. This issue specifically impacts Cargo versions from 3.6.X prior to 3.6.1. Exploiting this vulnerability could allow an attacker to manipulate SQL queries, potentially compromising the integrity of the database and exposing sensitive data.

References