Description
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| YesWiki | yeswiki | < 4.6.7 | 4.6.7 |
References
- GitHub Security Advisory (GHSA-4333-x9p4-8xj7) vendor-advisory
- VulnCheck Advisory: YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch third-party-advisory