Description

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard {{include page="…"}} link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table. This issue has been patched in version 4.6.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-05T00:17:19.963Z",
  "pubdate": "2026-09-05T00:17:19.963Z",
  "executiveSummary": "YesWiki versions 4.2.0 through 4.6.5 are susceptible to a critical SQL injection vulnerability within the ApiController component.\nThe vulnerability arises from improper sanitization of page tags, which are interpolated directly into SQL DELETE statements.\nAn authenticated user with low privileges can exploit this flaw to execute arbitrary SQL commands against the backend database.\nThis allows for unauthorized data exfiltration, including the use of time-based blind SQL injection techniques to extract information from any table within the database.\nThe attack requires the ability to create pages and trigger the deletion API, presenting a significant risk to data confidentiality and integrity.\nThe issue is addressed in version 4.6.6 through improved input handling and parameterization of database queries.",
  "technicalDetails": "The vulnerability is located in the ApiController::deletePage() method of YesWiki, which handles the deletion of wiki pages via the API endpoint POST /api/pages/{tag}.\nThe root cause is an insecure database interaction where the '$tag' variable, retrieved directly from the database after being user-supplied, is concatenated into a raw SQL query string: 'DELETE FROM …_links WHERE to_tag = '$tag''.\nBecause the application does not employ parameterized queries or adequate input escaping for the page tag, an attacker can manipulate the SQL query structure by injecting malicious SQL fragments.\nThe attack flow begins with the attacker creating a new wiki page. The system allows the creation of pages with arbitrary URL-encoded tags, enabling the attacker to set a tag value containing SQL control characters, such as a single quote (').\nTo ensure the vulnerable code path is reached, the attacker must ensure the page is considered 'non-orphaned' by establishing a relationship (e.g., using the {{include page='...'}} syntax), which populates the '_links' table monitored by the deletePage() function.\nUpon invoking the delete API for this crafted page, the malicious SQL fragment is executed by the database management system. This allows the attacker to break out of the intended query context and append arbitrary SQL commands, such as UNION statements or time-delay functions.\nExploitation allows for time-based blind SQL injection, where the attacker observes the server's response time to infer the contents of sensitive database tables. This provides a mechanism for unauthorized data extraction, potentially exposing the entire database contents, including credentials, configuration data, and user information.\nThe vulnerability affects YesWiki versions 4.2.0 up to, but not including, 4.6.6. Successful exploitation requires a low-privilege authenticated account to create the malicious page, after which the attacker can trigger the SQL injection via standard API interactions."
}