CVE-2026-104460

Summary

A blind SQL injection vulnerability exists in YesWiki's {{newtextsearch}} action that allows anonymous attackers to extract database information by crafting malicious Bazar list option IDs. This occurs because option IDs are concatenated directly into SQL REGEXP/LIKE clauses without proper escaping, enabling attackers to use search requests as a boolean oracle for data extraction.

Exploitability

Exploitation is moderately difficult and requires an attacker to have access to an anonymously editable Bazar list where they can inject malicious option IDs, but once achieved, allows full database enumeration through search queries.

Blast radius

If exploited, attackers could extract admin password hashes and potentially gain unauthorized access to the entire YesWiki instance, affecting all user accounts and potentially leading to complete system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to YesWiki 4.6.7 or later to address this blind SQL injection vulnerability in the {{newtextsearch}} action.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.