Executive brief
YesWiki, a collaborative wiki platform, contains a security flaw that allows unauthorized access to its internal database. By saving a specially crafted page, an attacker can trick the system into revealing sensitive information, such as user credentials or private site data. This could lead to a full breach of the site's data and compromise of administrative accounts.
Technical details
A SQL injection vulnerability exists in YesWiki's `recentchanges` action (`actions/recentchanges.php`). The application fails to validate the `period` argument when it is provided via an action invocation (e.g., `{{recentchanges period="..."}}`), bypassing a whitelist that only applies to URL query parameters. This unvalidated input is passed to `PageManager::getRecentlyChanged()`, where it is directly interpolated into a SQL query without escaping or parameterization. An attacker with page-editing privileges (which are granted to anonymous users by default) can perform UNION-based injection to exfiltrate arbitrary data from the database. The vulnerability is fixed in version 4.6.6.
Affected products
- YesWiki yeswiki < 4.6.6
Timeline
- 2026-06-02: disclosed
- 2026-06-02: patched: Fixed in version 4.6.6
- 2026-07-09: advisory
References
- https://api.github.com/users/CosmicCrusader23
- https://github.com/CosmicCrusader23
- https://api.github.com/users/CosmicCrusader23/gists%7B/gist_id%7D
- https://api.github.com/users/CosmicCrusader23/repos
- https://avatars.githubusercontent.com/u/217740635?v=4
- https://api.github.com/users/CosmicCrusader23/events%7B/privacy%7D