YesWiki: Unauthenticated SQL injection via Bazar entries search API
Summary
YesWiki's public Bazar entries search API does not properly escape field names from the query and searchfields parameters before placing them in a backtick-quoted SQL alias. An unauthenticated remote attacker can inject SQL SELECT expressions and read database content such as user password hashes, or exhaust database threads with SLEEP(). The attack requires only a reachable YesWiki instance with at least one Bazar form and no login.
Affected
- YesWiki 4.6.0 before 4.7.0
- YesWiki 5.0.0-alpha1 before 5.0.0-alpha4
- The lower bound is inconsistent across sources (4.6.0 or 4.6.7); treat all 4.6.x installations as affected until confirmed.
Fixed in
- Update to YesWiki 4.7.0
- Update to YesWiki 5.0.0-alpha4
- No backport for older 4.6.x branches has been confirmed.
Workaround
- No vendor workaround known.
- Generic WAF rules against backticks followed by SQL keywords have been suggested by third parties but cannot be verified and are not a substitute for patching.
Exploitation
- Not known to be exploited in the wild (no KEV listing found).
- No confirmed public exploit code at the time of research.
- The vendor advisory describes a validated blind, time-based oracle against unmodified 4.6.7 code.
Our recommendation
- Check every YesWiki installation for the version in use and update to 4.7.0 or 5.0.0-alpha4 without delay.
- Treat 4.6.x installations as affected until the lower bound is confirmed.
- If patching is not immediately possible, restrict access to the wiki and its Bazar API routes where feasible.
- Review database and admin accounts and change passwords after patching, since password hashes may have been exposed.
- Monitor web and database logs for requests to /api/forms/ or /api/entries/ containing backticks or SQL keywords, and for unusually long database queries.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-ccp2-6q93-hggh github.com
- GitHub Security Advisory GHSA-hgxv-w4r8-8877 github.com
- VulnCheck advisory for YesWiki 4.6.0 before 4.7.0 www.vulncheck.com
- HOL Guard CVE-2026-116207 entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:35.
Original description (NVD)
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.