Executive brief
YesWiki, a collaborative wiki platform, contains a security vulnerability that allows a logged-in user with low privileges to execute unauthorized database commands. By creating a page with a specially crafted name and then deleting it, an attacker can steal sensitive information like password hashes or delete site data. This could lead to a full takeover of the wiki or a significant disruption of service.
Technical details
A second-order SQL injection exists in `ApiController::deletePage()` and related delete handlers. While the initial `POST /api/pages/{tag}` correctly escapes input for storage, the `deletePage` method retrieves the raw tag from the database and interpolates it directly into a `DELETE FROM ..._links WHERE to_tag = '$tag'` query without re-escaping. An attacker can exploit this by creating a page with a tag containing SQL fragments (e.g., single quotes and SLEEP commands), ensuring the page is not 'orphaned' by linking to it from another page, and then calling the DELETE API. This allows for time-based blind data exfiltration or arbitrary data modification. The vulnerability is patched in version 4.6.6.
Affected products
- YesWiki yeswiki >= 4.2.0, < 4.6.6
Timeline
- 2026-06-02: advisory: GitHub Advisory published
- 2026-06-02: patched: Version 4.6.6 released