{"id":"CVE-2026-104460","published":"2026-10-02T12:17:18.140","lastModified":"2026-10-02T15:17:07.930","description":"YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4333-x9p4-8xj7","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-unauthenticated-blind-sql-injection-via-newtextsearch","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4333-x9p4-8xj7","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4333-x9p4-8xj7","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4333-x9p4-8xj7","tags":[]}],"hasPoc":true,"ai":{"summary":"A blind SQL injection vulnerability exists in YesWiki's {{newtextsearch}} action that allows anonymous attackers to extract database information by crafting malicious Bazar list option IDs. This occurs because option IDs are concatenated directly into SQL REGEXP/LIKE clauses without proper escaping, enabling attackers to use search requests as a boolean oracle for data extraction.","exploitability":"Exploitation is moderately difficult and requires an attacker to have access to an anonymously editable Bazar list where they can inject malicious option IDs, but once achieved, allows full database enumeration through search queries.","blast_radius":"If exploited, attackers could extract admin password hashes and potentially gain unauthorized access to the entire YesWiki instance, affecting all user accounts and potentially leading to complete system compromise.","remediation":"Upgrade to YesWiki 4.6.7 or later to address this blind SQL injection vulnerability in the {{newtextsearch}} action.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","blind-sql","wiki","bazar"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:03:20.415Z"}}