Executive brief
YetAnotherForum.NET (YAF.NET) is a popular open-source forum software built on ASP.NET. A security flaw allows any registered user, even those with the lowest level of access, to bypass administrative protections and execute arbitrary database commands. This could lead to the theft of sensitive user data, full deletion of the forum database, or unauthorized promotion of a regular user to a site administrator.
Technical details
A logic flaw in the authorization lifecycle of YAF.NET allows low-privileged users to bypass administrative access controls. The application uses PageSecurityCheckAttribute (a ResultFilterAttribute) to enforce admin restrictions; however, because ResultFilters execute after the page handler completes, the handler's side effects (such as database writes) occur before the authorization check redirects the user. An attacker can specifically target the /Admin/RunSql endpoint by sending a POST request to the OnPostRunQuery handler. This handler binds the 'Editor' parameter directly to a SQL execution method without additional permission checks, enabling arbitrary blind SQL injection. This can be used to extract data via time-based oracles, modify identity tables, or achieve OS-level command execution if the database environment is insufficiently hardened. The issue is resolved in version 4.0.5 by migrating authorization checks to IAsyncPageFilter.
Affected products
- YAFNET YetAnotherForum.NET (YAF.NET) < 4.0.5
Timeline
- 2026-04-26: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fix released in version 4.0.5