CVE-2026-52770 in YesWiki
Summary
by MITRE • 09/05/2026
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validation. An unauthenticated attacker can inject boolean SQL expressions and infer database contents from whether entries are returned. This issue has been patched in version 4.6.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
YesWiki is a collaborative wiki system implemented in PHP that provides various APIs for managing content, including the Bazar module which handles event listings and data entry management. The vulnerability identified affects versions prior to 4.6.6 within the public API endpoints responsible for listing entries from the Bazar database tables. Specifically, this flaw resides in how numeric query filters are processed when constructing SQL statements. While the application attempts to sanitize input by escaping certain characters, it fails to enforce strict type checking or wrap the value in quotes before insertion into the SQL command string. This architectural oversight allows an unauthenticated attacker to manipulate the structure of the underlying database queries through carefully crafted HTTP requests targeting these numeric filter parameters.
The technical core of this vulnerability is a classic blind boolean-based SQL injection flaw. Because the application does not validate that the input is strictly numeric, it accepts arbitrary strings and inserts them directly into the query context without proper quoting or casting to an integer type. This allows attackers to inject logical expressions such as true or false conditions into the WHERE clause of the SQL statement. By observing whether specific entries are returned in the API response, an attacker can perform boolean-based inference attacks. Over multiple iterations, this technique enables the extraction of sensitive data from the database, including user credentials, configuration details, and other private wiki content, effectively bypassing authentication mechanisms entirely since the affected endpoints do not require valid session tokens or login credentials to execute these malicious queries.
From a security classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command commonly known as SQL Injection. The specific vector involves numeric values being treated as code rather than data due to insufficient input validation and type coercion failures. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through exploitation of public-facing applications and Data Exfiltration via database query manipulation techniques such as Boolean-based blind SQL injection or time-based inference methods depending on implementation specifics. The lack of authentication requirement significantly lowers the barrier to entry for attackers, allowing automated scanning tools to discover and exploit these endpoints across large networks without needing prior credentials.
The operational impact of this vulnerability is severe given its unauthenticated nature. Attackers can potentially read arbitrary data from the YesWiki database, leading to full compromise of user accounts if password hashes are exposed or stored in a reversible format. Additionally, depending on the underlying Database Management System and configuration privileges granted to the web application's database user, there may be potential for further exploitation such as remote code execution via stacked queries or file read operations, although this depends heavily on specific server configurations. The integrity of the wiki content could also be compromised if attackers gain write access through similar injection vectors in other parts of the system that share the same flawed input handling patterns.
Mitigation strategies primarily involve upgrading to YesWiki version 4.6.6 or later where the developers have patched this issue by implementing proper numeric validation and ensuring all inputs are correctly quoted or parameterized before database interaction. For organizations unable to upgrade immediately, network-level controls such as Web Application Firewalls can be configured to detect and block SQL injection patterns in query parameters specifically targeting Bazar API endpoints. Input validation should also be enforced at the application layer by strictly casting numeric fields to integers using language-native functions like intval or filter_var with appropriate flags before any database operations occur. Regular security audits focusing on dynamic SQL construction practices are recommended to prevent similar vulnerabilities from arising in other modules of the platform.