Executive brief
YesWiki, a collaborative wiki platform, contains a security flaw that allows registered users to interfere with the site's database. By sending specially crafted requests to the reactions API, an attacker can bypass security controls to read or modify sensitive information, including user password hashes and emails. This could lead to a full compromise of the wiki's data and user accounts.
Technical details
An authenticated SQL injection vulnerability exists in YesWiki's `ReactionManager::deleteUserReaction()` function. The root cause is the direct concatenation of the `{idreaction}` and `{id}` URL path parameters into a SQL LIKE clause within the `TripleStore::delete()` method without proper escaping or parameterization. While one code path in the component correctly uses `$this->dbService->escape()`, an alternative branch fails to do so. An attacker with any level of authenticated access can exploit this via a DELETE request to the `/api/reactions/` endpoint to perform time-based blind SQL injection, enabling full database read/write access. The issue is patched in version 4.6.6.
Affected products
- YesWiki YesWiki < 4.6.6
Timeline
- 2026-06-02: disclosed: Initial disclosure and commit fix
- 2026-07-09: advisory: GitHub Advisory published