{"id":"CVE-2026-116207","published":"2026-10-25T14:17:01.847","lastModified":"2026-10-26T17:17:24.047","description":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877","tags":[]}],"hasPoc":true,"ai":{"summary":"YesWiki versions before 4.7.0 and 5.0.0-alpha4 contain an unauthenticated SQL injection in the SearchManager::prepareSearchRequest() method, where user-controlled field names from the query and searchfields parameters are improperly embedded into SQL aliases using backtick quoting and insufficient escaping, allowing attackers to inject arbitrary SQL subqueries.","exploitability":"Exploitation is trivial for remote attackers as it requires no authentication, privileges, or user interaction and leverages publicly available SQL injection techniques.","blast_radius":"Successful exploitation could lead to full database compromise including extraction of sensitive data like password hashes, or denial of service via resource exhaustion (e.g., SLEEP() calls), impacting confidentiality and availability of the underlying system.","remediation":"Upgrade to YesWiki 4.7.0 or later, or for 5.x pre-releases, to 5.0.0-alpha4 or later.","detection":"Look for HTTP requests to the Bazar entries search API endpoint containing suspicious patterns in the query or searchfields parameters, such as unbalanced backticks, SQL keywords (e.g., SELECT, UNION, SLEEP), or unusually long parameter values; these may appear in web server access logs or WAF alerts.","tags":["sql-injection","unauthenticated","webapp","bazar","yeswiki"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:53:49.129Z"}}