A critical SQL injection vulnerability in the FTB-Gamepedia Tilesheets extension for MediaWiki allows unauthenticated attackers to execute unauthorized database queries, posing a significant risk to data integrity and confidentiality.

This vulnerability is an SQL injection flaw (CWE-89) triggered by a missing backtick in a query executed by the extension. An unauthenticated attacker can leverage this flaw to manipulate database interactions, potentially leading to unauthorized data access or modification.

Successful exploitation of this vulnerability could lead to the compromise of the underlying MediaWiki database, resulting in unauthorized access to sensitive site information or full data exfiltration. Given the CVSS score of 7.3, this represents a high-severity risk that could cause significant operational disruption and loss of trust in the platform's security posture.

Immediate Action: As no official patch is currently available, administrators should immediately disable the Tilesheets extension until a fix is released by the vendor.

Proactive Monitoring: Review database and application logs for unusual query patterns, specifically looking for attempts to inject SQL syntax or unexpected database error messages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting MediaWiki extensions.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to any MediaWiki instance utilizing the Tilesheets extension. Given the potential for unauthorized database manipulation, organizations must prioritize the immediate deactivation of the extension. Monitor the vendor GitHub repository for the release of an updated version and conduct a thorough audit of the database for signs of prior unauthorized access once the component is disabled.