Description
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| YesWiki | yeswiki | 4.6.0 – < 4.7.0, 5.0.0-alpha1 – < 5.0.0-alpha4 | 4.7.0 |
References
- GitHub Security Advisory (GHSA-ccp2-6q93-hggh) vendor-advisory
- GitHub Security Advisory (GHSA-hgxv-w4r8-8877) vendor-advisory
- VulnCheck Advisory: YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API third-party-advisory