CVE-2025-54865
Published: 05 August 2025
Summary
CVE-2025-54865 is a high-severity SQL Injection (CWE-89) vulnerability in Ftb-Gamepedia Tilesheets. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-54865 is a SQL injection vulnerability (CWE-89) in the Tilesheets MediaWiki Extension, which provides a table lookup parser function to retrieve images based on item queries. The flaw stems from a missing backtick in a database query executed by the extension, specifically in the SheetManager.php file at line 255, enabling the injection of malicious SQL code. The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and affects MediaWiki installations using the Tilesheets extension from the FTB-Gamepedia repository.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By crafting malicious input via the extension's parser function, attackers can insert and potentially execute arbitrary SQL code, resulting in limited impacts: low confidentiality (e.g., unauthorized data access), integrity (e.g., data modification), and availability (e.g., denial of service).
The GitHub security advisory (GHSA-hqfr-7cm9-4h87) documents the issue but notes that it has not been fixed, with no patches available as of the CVE publication on 2025-08-05. Security practitioners should disable or remove the Tilesheets extension until a fix is released, and monitor for updates from the repository maintainers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23577
Vulnerability details
Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the Tilesheets extension allows users to insert and potentially execute malicious SQL code. This issue…
more
has not been fixed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing MediaWiki extension directly enables remote exploitation of a web application without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted input to the parser function, blocking the malicious SQL payload that exploits the missing backtick.
Requires disabling or removing non-essential components such as the unfixed Tilesheets extension until the SQL injection flaw is resolved.
Mandates prompt remediation of identified flaws (via patch or documented workaround) in the affected MediaWiki extension.