Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-05T00:17:20.520Z",
  "pubdate": "2026-09-05T00:17:20.520Z",
  "executiveSummary": "The YesWiki wiki system contains a critical SQL injection vulnerability in the ReactionManager::deleteUserReaction() function, impacting all versions prior to 4.6.6.\nThis vulnerability arises from improper handling of user-supplied input within database queries. Specifically, the {idreaction} and {id} URL parameters are concatenated directly into a SQL LIKE clause without the use of parameterized queries or adequate input sanitization.\nThe vulnerability allows an authenticated attacker to manipulate backend SQL queries, potentially leading to unauthorized data exfiltration, database modification, or complete compromise of the underlying database instance.\nExploitation requires the attacker to hold an authenticated session within the YesWiki application. Due to the nature of SQL injection, the impact is significant, potentially granting an adversary the ability to bypass application logic and access sensitive data stored within the database.\nRemediation requires upgrading the YesWiki installation to version 4.6.6 or later, which introduces necessary input sanitization and parameterization to mitigate this injection vector.",
  "technicalDetails": "The vulnerability is located within the ReactionManager::deleteUserReaction() component of the YesWiki codebase. The root cause is the unsafe handling of user-supplied data that is subsequently integrated into SQL query strings.\nThe application accepts {idreaction} and {id} parameters via the URL path, which are intended to identify reaction records for deletion. These parameters are processed by the ReactionManager without proper validation, escaping, or the use of prepared statements.\nThe vulnerable code pattern involves direct concatenation of these raw parameters into a SQL command utilizing a LIKE clause. By injecting malicious SQL syntax into the {idreaction} or {id} parameters, an attacker can escape the intended query context and execute arbitrary SQL commands against the database.\nThe attack flow begins with an authenticated user crafting a malicious request directed at the affected endpoint. By including SQL-specific characters and commands (e.g., UNION SELECT statements, boolean inference vectors, or stacked queries depending on the database driver capabilities), the attacker can force the database to execute unintended operations.\nBecause the input is not parameterized, the database engine interprets the malicious input as part of the SQL instruction set rather than as literal string data. This results in the elevation of attacker control over the database, which may lead to the disclosure of sensitive wiki content, user credentials, or administrative session data.\nThis vulnerability is restricted to authenticated users, meaning the exposure is limited to those who have obtained a valid session. However, in environments where guest or low-privileged registration is enabled, the attack surface expands significantly. The risk is high due to the potential for full database compromise. The issue persists across the legacy codebase up to version 4.6.6, where the vendor implemented parameterization to ensure that input is treated exclusively as data, effectively neutralizing the injection vector."
}