CVE-2026-104457 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to a critical SQL injection vulnerability located within the Bazar filtertags action module. This flaw stems from improper handling of user-supplied input during the construction of database queries, specifically when processing the filterN attribute tokens. The application logic wraps these unescaped tokens in quotes and concatenates them directly into a raw tags.value IN clause without adequate sanitization or parameterization. In default installation configurations, this architectural weakness allows for significant exploitation by attackers who do not require prior authentication to interact with the vulnerable endpoint.
The technical mechanism of the exploit relies on MySQL's specific handling of backslash escaping sequences within string literals. An attacker can craft a malicious payload containing a trailing-backslash token that is saved as part of page markup via the filtertags action. When this input is processed, the presence of the unescaped backslash alters how the database engine interprets the subsequent quote characters in the SQL statement. This manipulation effectively breaks the parity of the quoted string delimiter, allowing the attacker to terminate the intended query context and inject arbitrary SQL commands. By leveraging this injection point, an adversary can execute a five-column UNION-based subquery attack against the underlying MySQL database.
The operational impact of this vulnerability is severe due to its unauthenticated nature and the breadth of data exposure it enables. Attackers with no prior access credentials can traverse the database schema and extract sensitive information from arbitrary tables. Most critically, this includes retrieving password hashes stored in user account records. The compromise of these cryptographic secrets facilitates further attacks such as credential stuffing or offline brute-force cracking, potentially leading to full system takeover if weak hashing algorithms are employed. This represents a complete bypass of authentication controls for the affected data store and poses an immediate risk to the confidentiality and integrity of the application's user base.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The exploitation technique described corresponds to ATT&CK tactic T1059 Command and Scripting Interpreter through database interaction, specifically falling under sub-techniques related to data exfiltration via structured query language manipulation. To mitigate this risk, administrators must upgrade the YesWiki installation to version 4.6.7 or later where these input validation checks have been corrected. Additionally, implementing parameterized queries for all dynamic SQL construction is a fundamental best practice that would prevent such injection vectors regardless of specific application logic changes. Input sanitization should also be enforced at the entry point to ensure special characters like backslashes are properly escaped before being passed to database drivers.