CVE-2025-54865 - Tilesheets MediaWiki Extension is Vulnerable to Potential SQL Injection

Back Back to CVE browser

CRITICAL

Tilesheets MediaWiki Extension is Vulnerable to Potential SQL Injection

Published Aug 5, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 0.37%

Description

Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the Tilesheets extension allows users to insert and potentially execute malicious SQL code. This issue has not been fixed.

Affected products

Vendor FTB-Gamepedia Product Tilesheets Default
n/a
- Version
  <= 5.0.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FTB-Gamepedia

Tilesheets

n/a

Version	Status	Constraints
<= 5.0.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://github.com/FTB-Gamepedia/Tilesheets/blob/8debbf8ee6ddb02bf9c756bab5c085b007d72c50/special/SheetManager.php#L255
x_refsource_MISCProduct
https://github.com/FTB-Gamepedia/Tilesheets/security/advisories/GHSA-hqfr-7cm9-4h87
exploitx_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/FTB-Gamepedia/Tilesheets/blob/8debbf8ee6ddb02bf9c756bab5c085b007d72c50/special/SheetManager.php#L255		x_refsource_MISCProduct
https://github.com/FTB-Gamepedia/Tilesheets/security/advisories/GHSA-hqfr-7cm9-4h87		exploitx_refsource_CONFIRMVendor Advisory