Description

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-02T12:17:18.140Z",
  "pubdate": "2026-10-02T12:17:18.140Z",
  "executiveSummary": "YesWiki versions prior to 4.6.7 are susceptible to a critical blind SQL injection vulnerability residing within the {{newtextsearch}} action. The flaw originates from improper input sanitization, allowing an attacker to manipulate backend database queries.\nBy injecting malicious input into an anonymously editable Bazar list, an unauthorized actor can leverage the search functionality as a boolean-based oracle. This mechanism enables the systematic exfiltration of sensitive information from the underlying database, including the retrieval of administrative password hashes stored within the yeswiki_users table.\nThe vulnerability is exploitable by remote, unauthenticated attackers, posing a significant risk to the confidentiality and integrity of the YesWiki installation. Successful exploitation does not require prior administrative access, as the injection vector utilizes public-facing features. Organizations utilizing affected versions are at high risk of full database compromise and should prioritize remediation to prevent unauthorized data access.",
  "technicalDetails": "The vulnerability is located in actions/newtextsearch.php, specifically within the logic processing the {{newtextsearch}} action. The root cause is the improper handling of Bazar list option IDs. During query construction, these identifiers are concatenated directly into SQL REGEXP or LIKE clauses without sufficient escaping or the use of prepared statements.\nThe exploitation flow begins with the attacker interacting with an anonymously editable Bazar list feature. Because the application fails to validate or sanitize user-supplied input for these list options, an attacker can supply crafted payloads containing SQL syntax characters designed to alter the logic of subsequent database queries. Specifically, the attacker injects SQL fragments into the option IDs, which are later processed by the vulnerable search action.\nWhen a user or attacker triggers a search request via the {{newtextsearch}} component, the application executes the injected SQL command. By observing variations in the application response—such as search result count changes or boolean true/false states—the attacker can perform blind SQL injection. This side-channel information is used to infer the contents of the database character by character.\nThis boolean-based oracle approach is highly effective for data exfiltration. An attacker can systematically extract the entire database schema and record content. Of particular concern is the ability to target the yeswiki_users table to extract hashed administrative credentials, which can then be subjected to offline brute-force or dictionary attacks to gain full administrative control over the wiki instance.\nThe vulnerability is present in all YesWiki versions prior to 4.6.7. As the vulnerable code path is reachable through standard application features that support anonymous interactions, no specialized privileges or session tokens are required to initiate the attack. The reliance on string concatenation for query building rather than parameterized queries or abstraction layers that handle input sanitization inherently exposes the database to arbitrary command execution based on the privileges of the web application's database user."
}