CVE-2025-32956: Miraheze ManageWiki SQLi Vulnerability

CVE-2025-32956 Overview

CVE-2025-32956 is a SQL injection vulnerability [CWE-89] in Miraheze ManageWiki, a MediaWiki extension that allows users to manage wikis. The flaw exists in the Special:ManageWiki/namespaces interface when renaming a namespace. An authenticated user supplying a malicious page prefix (the current namespace name being renamed) can inject arbitrary SQL into backend queries. The vulnerability affects all versions prior to commit f504ed8. Maintainers patched the issue in commit f504ed8eeb59b57ebb90f93cd44f23da4c5bc4c9, and operators can mitigate exposure by disabling namespace management through the $wgManageWiki['namespaces'] configuration flag.

Critical Impact
Authenticated attackers with namespace management privileges can execute arbitrary SQL queries against the MediaWiki database, compromising confidentiality, integrity, and availability of wiki data.

Affected Products

Miraheze ManageWiki MediaWiki extension (all versions before commit f504ed8)
MediaWiki installations running ManageWiki with namespace management enabled ($wgManageWiki['namespaces'] = true)
Miraheze-hosted and self-hosted wiki farms using ManageWiki

Discovery Timeline

2025-04-21 - CVE-2025-32956 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32956

Vulnerability Analysis

The vulnerability resides in the namespace rename workflow exposed via Special:ManageWiki/namespaces. When an administrator renames a namespace, ManageWiki builds a database query that incorporates the current namespace name (the page prefix) as part of an SQL statement. Because this user-controlled value is interpolated into the query without proper parameterization or escaping, an attacker who supplies a crafted namespace name can break out of the intended SQL context.

Successful exploitation grants the attacker the ability to read, modify, or delete arbitrary database rows accessible to the MediaWiki database user. This includes user credentials, session tokens, page content, and configuration tables shared across wikis on multi-tenant Miraheze deployments.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The namespace rename code path concatenated or interpolated the namespace prefix string directly into a SQL statement instead of binding it as a parameter through MediaWiki's database abstraction layer. Any wiki user with rights to manage namespaces could therefore inject SQL syntax via the namespace name field.

Attack Vector

Exploitation requires network access to the wiki, an authenticated account with permissions to manage namespaces, and user interaction with the Special:ManageWiki/namespaces form to submit the rename action. An attacker navigates to the namespaces management page, selects a namespace to rename, and provides an injection payload as the page prefix value. The application executes the tainted SQL against the backend database.

The two security patches published by Miraheze illustrate the cleanup applied in the fix commit:

text

 	<file>.</file>
 	<rule ref="./vendor/mediawiki/mediawiki-codesniffer/MediaWiki">
 		<exclude name="Generic.Files.LineLength.TooLong" />
-		<exclude name="MediaWiki.Commenting.FunctionComment" />
 	</rule>
 	<rule ref="Generic.Functions.FunctionCallArgumentSpacing.TooMuchSpaceAfterComma">
 		<severity>5</severity>

Source: GitHub Commit f504ed8

The i18n changes accompany the broader cleanup that hardens the namespace rename code path:

text

 	"logentry-managewiki-settings": "$1 {{GENDER:$2|changed}} the settings \"$5\" for \"$4\"",
+	"logentry-managewiki-settings-reset": "$1 {{GENDER:$2|reset}} the settings to the defaults for \"$4\"",
 	"logentry-managewiki-undelete": "$1 {{GENDER:$2|undeleted}} the wiki \"$4\"",

Source: GitHub Commit f504ed8

Detection Methods for CVE-2025-32956

Indicators of Compromise

Unusual entries in the ManageWiki log for namespace rename events containing SQL keywords such as UNION, SELECT, --, or ;.
Database error messages in MediaWiki logs originating from requests to Special:ManageWiki/namespaces.
Unexpected modifications to MediaWiki tables such as user, user_groups, or page immediately following a namespace rename action.
Authentication events for accounts that subsequently access namespace management features without operational justification.

Detection Strategies

Inspect HTTP request logs for POST submissions to Special:ManageWiki/namespaces containing SQL meta-characters in form fields.
Enable and review MediaWiki's debug log for database query errors tied to namespace rename operations.
Compare installed ManageWiki commit hash against the patched commit f504ed8eeb59b57ebb90f93cd44f23da4c5bc4c9 to identify vulnerable instances.

Monitoring Recommendations

Forward web server, MediaWiki debug, and database audit logs to a centralized SIEM for correlation.
Alert on database queries originating from the wiki user that fall outside the application's normal query patterns.
Track changes to the $wgManageWiki configuration array to confirm the workaround remains enforced where patching is delayed.

How to Mitigate CVE-2025-32956

Immediate Actions Required

Update ManageWiki to a revision that includes commit f504ed8eeb59b57ebb90f93cd44f23da4c5bc4c9 or later.
Audit accounts with namespace management permissions and revoke access for users that do not require it.
Review ManageWiki and MediaWiki logs for prior namespace rename actions containing suspicious payloads.
Rotate database credentials and user session tokens if exploitation is suspected.

Patch Information

The vulnerability is fixed in ManageWiki commit f504ed8eeb59b57ebb90f93cd44f23da4c5bc4c9. Operators should pull the latest ManageWiki code from the Miraheze ManageWiki repository and redeploy. Full details are published in the GHSA-gg42-cv66-f5x7 advisory.

Workarounds

Disable namespace management in ManageWiki by setting $wgManageWiki['namespaces'] = false; in LocalSettings.php until the patch can be applied.
Restrict access to Special:ManageWiki/namespaces to trusted administrators via MediaWiki user rights configuration.
Place the wiki behind a web application firewall with rules that block SQL injection patterns on ManageWiki endpoints.

bash

# Configuration example - disable namespace management as a workaround
# Add the following to LocalSettings.php
$wgManageWiki['namespaces'] = false;