SQL Injection in MediaWiki Cargo Extension

Compliance Impact

The SQL injection vulnerability in the Mediawiki Cargo Extension allows unauthenticated attackers to exfiltrate sensitive data from the database. This unauthorized access to sensitive data could lead to violations of data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized disclosure.

Because the vulnerability enables attackers to manipulate SQL queries and retrieve data without proper authorization, organizations using the affected software may face compliance risks related to confidentiality, integrity, and availability of protected data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-14363 is a SQL injection vulnerability in the Cargo extension for MediaWiki, specifically affecting the Special:Drilldown page. This vulnerability arises because the extension's code concatenates user-supplied input directly into SQL queries without proper sanitization or neutralization of special SQL elements.

An attacker can manipulate URL parameters to inject malicious SQL code, which can alter the behavior of the database queries executed by the extension. For example, by injecting crafted input, an attacker can cause the system to return all records or no records, demonstrating the ability to control the SQL query logic.

The root cause is the use of string concatenation in the `checkSQL()` function in `CargoAppliedFilter.php` instead of using parameterized queries or MediaWiki's database abstraction layers, which would properly handle user input.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to perform SQL injection attacks on the MediaWiki Cargo extension, potentially leading to unauthorized access to sensitive data stored in the database.

Because the affected page (Special:Drilldown) is accessible to anonymous users by default, attackers do not need any privileges to exploit this flaw.

The impact includes data exfiltration, unauthorized data disclosure, and possibly manipulation of database queries, which can compromise the confidentiality and integrity of the data managed by the MediaWiki installation.

Useful 0 Not Useful 0

Detection Guidance

This SQL injection vulnerability in the Mediawiki Cargo Extension can be detected by testing the Special:Drilldown page for SQL injection flaws using crafted URL parameters.

For example, manipulating URL parameters to inject SQL code can reveal the vulnerability. Using URLs like the following can help detect it:

• Special:Drilldown/TABLENAME?_lower_DATEFIELDNAME[year]=1&_lower_DATEFIELDNAME[month]=1&_lower_DATEFIELDNAME[day]=1') AND ('1'='1
• Special:Drilldown/TABLENAME?_lower_DATEFIELDNAME[year]=1&_lower_DATEFIELDNAME[month]=1&_lower_DATEFIELDNAME[day]=1') AND ('2'='1

The first URL returns all records (indicating a successful injection), while the second returns no records, demonstrating the presence of SQL injection.

Another detection method involves using tab characters to bypass input validation, such as:

• Special:Drilldown/TABLENAME?DATEFIELDNAME[]=2010 OR 1=1

These tests can be performed manually by accessing the URLs or automated using tools that test for SQL injection by injecting payloads into URL parameters.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating the Mediawiki Cargo Extension to a patched version where the SQL injection vulnerability has been addressed.

The vulnerability was fixed by applying patches that validate date fields and refactor the code to use MediaWiki's database abstraction layer, such as SelectQueryBuilder, to build parameterized queries instead of unsafe string concatenation.

Until the update is applied, consider restricting access to the Special:Drilldown page or disabling the Cargo extension if feasible, to prevent unauthenticated attackers from exploiting the SQL injection.

Useful 0 Not Useful 0