Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication. During validation, the vulnerable widget route returned the injected HTML for both /HomePage/widget?id=... and /NoSuchPage/widget?id=..., which shows that no login, no page ownership, no edit rights, and not even a valid page tag were required. The only routing prerequisite observed was that the Bazar extension is enabled and the request includes an id parameter. This issue has been patched in version 4.6.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-05T00:17:20.380Z",
  "pubdate": "2026-09-05T00:17:20.380Z",
  "executiveSummary": "YesWiki versions prior to 4.6.6 are vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability within the Bazar widget handler. This vulnerability arises due to the insufficient sanitization of the id GET parameter before reflection into HTML attributes.\nBy injecting a crafted payload containing double quotes, an attacker can break out of the intended attribute context to inject arbitrary JavaScript event handlers such as onmouseover. This allows for the execution of malicious scripts within the context of the victim's session.\nThe vulnerability is critical as it requires no authentication, page ownership, or edit privileges. An attacker can trigger the execution by merely persuading a victim to interact with a crafted URL targeting the Bazar widget route. Successful exploitation can lead to session hijacking, sensitive data exfiltration, or unauthorized actions performed on behalf of the user.\nThe vulnerability is globally accessible as long as the Bazar extension is enabled, regardless of whether the target page exists. All organizations utilizing YesWiki versions prior to 4.6.6 are at risk and are advised to upgrade to the patched release immediately.",
  "technicalDetails": "The vulnerability originates in the Bazar widget handler component of YesWiki, which fails to adequately sanitize user-supplied input delivered via the id GET parameter. While the system utilizes the strip_tags() function to mitigate injection attempts, this function is insufficient for sanitizing data reflected into HTML attributes. Specifically, strip_tags() does not neutralize double quotes, which are essential for breaking out of attribute definitions in HTML.\nExploitation occurs when an attacker crafts a malicious URL containing a payload designed to terminate the intended attribute value prematurely. By inserting a double quote, the attacker closes the attribute and introduces new HTML attributes, such as event handlers (e.g., 'onmouseover=alert(1)'). When a victim visits this URL, the browser parses the reflected input as executable HTML, triggering the injected JavaScript within the victim's document object model (DOM).\nThe attack flow is straightforward and lacks complex preconditions. An attacker initiates the request to /HomePage/widget?id=[payload] or /NoSuchPage/widget?id=[payload]. Because the Bazar extension does not validate the existence of the page or the session status of the requester, the server reflects the malicious payload back to the client response. The lack of validation ensures that the exploit is functional even against non-existent pages, increasing the attack surface.\nThis XSS vulnerability is particularly severe due to the ease of reachability. No authentication is required, and the attacker does not need to possess any administrative or edit rights within the YesWiki instance. The impact post-exploitation includes, but is not limited to, the theft of session cookies, CSRF (Cross-Site Request Forgery) attacks against authenticated administrative panels, and the manipulation of the wiki content displayed to the victim.\nThis issue has been addressed in YesWiki version 4.6.6. Remediation in the patch likely involves replacing or supplementing strip_tags() with a more robust context-aware output encoding mechanism that escapes characters like double quotes (e.g., converting '\"' to '"') before rendering the id parameter in the HTML response."
}