CVE-2026-116211 in YesWiki
Summary
by MITRE • 10/25/2026
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
YesWiki versions prior to 4.7.0 contain a critical SQL injection vulnerability located within the PageManager::save() method, specifically affecting the handling of Bazar entry creation requests. The root cause lies in the improper neutralization of special elements used in an SQL command for the date_maj_fiche field. When processing new entries, the application concatenates this user-supplied input directly into an INSERT statement without applying adequate sanitization or parameterized queries. This architectural flaw allows attackers to inject arbitrary SQL code that is subsequently executed by the underlying database management system, bypassing intended security controls and altering the execution logic of the query.
The operational impact of this vulnerability is severe due to its unauthenticated nature on default installations. Attackers do not require valid credentials or prior authentication to exploit this flaw, significantly lowering the barrier for entry in typical deployment scenarios where anonymous access is permitted for creating new wiki pages or Bazar entries. By crafting a malicious payload within the date_maj_fiche parameter, an attacker can manipulate the SQL query structure to perform sub-select operations against internal database tables. Specifically, the vulnerability enables the exfiltration of sensitive data such as password hashes from the wiki_users table. This compromise undermines the confidentiality and integrity of user credentials stored in the system.
From a classification perspective, this flaw aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attack vector is categorized under ATT&CK technique T1059 Command and Scripting Interpreter if considering the broader context of command execution via database extensions, but more accurately fits within data exfiltration patterns associated with unauthorized access to stored information. The ability to extract password hashes poses a direct risk to account security, as these hashes can be subjected to offline brute-force or rainbow table attacks to recover plaintext passwords, potentially leading to full system compromise if those credentials are reused across other services.
Mitigation strategies should prioritize immediate upgrading of the YesWiki installation to version 4.7.0 or later, where this specific input validation and sanitization issue has been addressed by developers. For environments that cannot be immediately patched, administrators should enforce strict access controls on Bazar entry creation endpoints to ensure only authenticated users with appropriate privileges can submit data through these forms. Additionally, implementing Web Application Firewall rules capable of detecting SQL injection patterns in form submissions may provide a temporary layer of defense against exploitation attempts while permanent fixes are deployed. Regular security audits and code reviews focusing on database interaction layers are recommended to prevent similar vulnerabilities arising from unescaped user input in future development cycles.