Description (CNA)
Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the Tilesheets extension allows users to insert and potentially execute malicious SQL code. This issue has not been fixed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| FTB-Gamepedia / Tilesheets | affected <= 5.0.3 |
CWE
CWE-89
References
- https://github.com/FTB-Gamepedia/Tilesheets/security/advisories/GHSA-hqfr-7cm9-4h87
- https://github.com/FTB-Gamepedia/Tilesheets/blob/8debbf8ee6ddb02bf9c756bab5c085b007d72c50/special/SheetManager.php#L255
ADP enrichment
No English description supplied.