CVE-2025-32956: ManageWiki has SQL injection vulnerability in NamespaceMigrationJob
ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix (namespace name, which is the current namespace you are renaming) with an injection payload. This issue has been patched in commit f504ed8. A workaround for this vulnerability involves setting $wgManageWiki['namespaces'] = false;.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32956?
CVE-2025-32956 is classified as a critical severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-32956?
To fix CVE-2025-32956, upgrade your ManageWiki extension to the version that includes commit f504ed8 or later.
What causes CVE-2025-32956?
CVE-2025-32956 is caused by insufficient input validation when renaming a namespace in the ManageWiki extension.
Which versions of ManageWiki are affected by CVE-2025-32956?
All versions of ManageWiki prior to commit f504ed8 are vulnerable to CVE-2025-32956.
What are the potential impacts of exploiting CVE-2025-32956?
Exploiting CVE-2025-32956 can allow attackers to execute arbitrary SQL commands, compromising the integrity of the database.