SQL Injection in MediaWiki Cargo Extension

Executive Summary

CVE-2026-58521 is a SQL injection vulnerability in the Cargo extension for MediaWiki, specifically in the year range filter of Special:Drilldown.

The vulnerability occurs because the extension does not properly sanitize user input before inserting it into a SELECT SQL query, allowing attackers to inject malicious SQL code.

This improper neutralization of special elements used in SQL commands enables attackers to manipulate database queries.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to a complete account takeover by exfiltrating sensitive data such as the user_token, even bypassing two-factor authentication if enabled.

Attackers can also perform denial-of-service attacks by executing resource-intensive queries that degrade system performance.

The impact depends on the database user privileges; if the default database user has access to sensitive tables, the risk is higher.

Disabling Special:Drilldown or applying the patch that validates year values can mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in the MediaWiki Cargo Extension can lead to a complete account takeover by exfiltrating sensitive information such as the user_token, which can bypass two-factor authentication if enabled.

This exposure of sensitive user data and potential unauthorized access could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

Additionally, the vulnerability allows denial-of-service attacks, which could affect system availability, another important aspect of regulatory compliance.

Useful 0 Not Useful 0

Detection Guidance

This SQL injection vulnerability in the MediaWiki Cargo extension can be detected by testing the year range filter in Special:Drilldown for improper input sanitization.

Proof-of-concept attacks demonstrated include time-based SQL injection using commands such as SLEEP functions and logical conditions like "1=1" to manipulate queries.

To detect the vulnerability, you can attempt injecting SQL payloads into the year range filter input fields and observe if the system behaves abnormally or delays responses (indicative of time-based injections).

• Use SQL injection test payloads such as '1 OR 1=1' or '1; SLEEP(5); --' in the year range filter input.
• Monitor response times for delays that indicate execution of injected SQL commands.
• Check logs for unusual queries or errors related to the year range filter in Special:Drilldown.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the patch developed and merged to validate year values in the Special:Drilldown filter, which prevents SQL injection.

If patching is not immediately possible, disabling the Special:Drilldown feature will mitigate the vulnerability.

Additionally, review and restrict database user privileges to limit access to sensitive tables such as user_token, reducing the impact of potential exploitation.

• Apply the official patch that validates input for the year range filter.
• Disable the Special:Drilldown feature temporarily if patching is delayed.
• Restrict database user permissions to prevent access to sensitive data.

Useful 0 Not Useful 0