Description

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archived revision, and execute arbitrary JavaScript in the victim's browser. The vulnerable form is only rendered when the victim can both read and edit the target page. In restricted deployments this requires a victim with read and write access to that page. On a default doryphore 4.6.5 install, public pages such as PagePrincipale were editable anonymously during validation, so the issue can also affect unauthenticated visitors in that configuration. This issue has been patched in version 4.6.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-05T00:17:20.243Z",
  "pubdate": "2026-09-05T00:17:20.243Z",
  "executiveSummary": "YesWiki versions 4.1.0 through 4.6.5 are susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability via the archived-revision view. The vulnerability arises from insufficient sanitization of the 'time' GET parameter within 'handlers/page/show.php'. By injecting malicious scripts into this parameter, an attacker can execute arbitrary JavaScript in the context of a victim's session.\nThe vulnerability is facilitated by MySQL's coercion of malformed DATETIME strings, which allows the application to process valid revisions while simultaneously embedding malicious payloads into the rendered HTML. Successful exploitation results in unauthorized script execution, potentially leading to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the user.\nThe risk is highly dependent on the authorization configuration of the YesWiki instance. While the vulnerability typically requires the victim to have both read and edit permissions, default configurations such as 'doryphore 4.6.5' may permit unauthenticated exploitation on pages where anonymous editing is enabled by default. The issue is resolved in version 4.6.6.",
  "technicalDetails": "The vulnerability resides in 'handlers/page/show.php', which fails to properly escape the 'time' GET parameter before reflecting it into a hidden HTML input field within the archived-revision view. When a user requests an archived version of a page, the 'time' parameter is used to identify the revision. Due to the backend database's behavior regarding DATETIME handling, MySQL may coerce malformed input strings into a format that the application accepts as a valid timestamp, provided the initial portion of the string matches a legitimate revision date.\nThe attack flow begins when an attacker crafts a malicious URL containing a JavaScript payload appended to a valid timestamp string within the 'time' parameter. When a victim with the necessary privileges accesses this crafted URL, the server renders the archived page. The backend processes the input, and the application reflects the attacker-supplied payload directly into the 'value' attribute of a hidden input element within the HTML response. Because the application fails to perform context-aware output encoding or input validation on this parameter, the browser interprets the injected string as executable script.\nExploitation requirements include the victim possessing at least read and edit permissions for the targeted wiki page, as the vulnerable form is conditionally rendered based on these access control checks. However, in configurations where anonymous editing is enabled, such as the default 'doryphore 4.6.5' deployment on public-facing pages like 'PagePrincipale', the requirement for authenticated access is bypassed, exposing the system to unauthenticated remote attackers. The post-exploitation impact includes the capability to intercept session cookies, manipulate the Document Object Model (DOM), perform cross-site request forgery (CSRF) actions, or redirect users to malicious domains, all executed within the victim's authenticated security context."
}