CVE-2026-116207

Summary

YesWiki versions before 4.7.0 and 5.0.0-alpha4 contain an unauthenticated SQL injection in the SearchManager::prepareSearchRequest() method, where user-controlled field names from the query and searchfields parameters are improperly embedded into SQL aliases using backtick quoting and insufficient escaping, allowing attackers to inject arbitrary SQL subqueries.

Exploitability

Exploitation is trivial for remote attackers as it requires no authentication, privileges, or user interaction and leverages publicly available SQL injection techniques.

Blast radius

Successful exploitation could lead to full database compromise including extraction of sensitive data like password hashes, or denial of service via resource exhaustion (e.g., SLEEP() calls), impacting confidentiality and availability of the underlying system.

Detection

Look for HTTP requests to the Bazar entries search API endpoint containing suspicious patterns in the query or searchfields parameters, such as unbalanced backticks, SQL keywords (e.g., SELECT, UNION, SLEEP), or unusually long parameter values; these may appear in web server access logs or WAF alerts.

Prioritized remediation

Upgrade to YesWiki 4.7.0 or later, or for 5.x pre-releases, to 5.0.0-alpha4 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.