Summary
YesWiki contains a second-order SQL injection vulnerability in its ACL update logic, where a previously stored username is later incorporated into a database query without adequate escaping. An attacker who can register a crafted account name may cause SQL manipulation when accessing non-administrative ACL-filtered listings, potentially exposing database contents and bypassing read restrictions.
Affected context
The vulnerability occurs in YesWiki deployments where self-registration is enabled and account names are stored without sufficient normalization or validation. Risk arises when the stored username is subsequently reused by AclService::updateRequestWithACL while constructing a read-ACL LIKE clause for filtered listings. The issue affects deployments using the vulnerable ACL processing behavior before the fixed release boundary.
Exploit preconditions
- Attack surface: Self-registration and ACL-filtered listing functionality
- Required access: Ability to create a user account, subject to any registration controls
- Trigger point: Loading a non-administrative listing that invokes read-ACL query construction
- Why exploitation is possible: A stored account name is later concatenated into a SQL expression without adequate parameterization or escaping, enabling second-order query manipulation
Why this happens
The underlying defect is an SQL injection flaw caused by treating persisted user-controlled data as trusted query syntax. A username accepted during account creation is stored and later concatenated into a read-ACL LIKE clause instead of being safely bound as a query parameter or handled through a strictly constrained query-building interface. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') and represents a second-order injection pattern.
Potential impact
- An attacker may read database contents beyond intended ACL boundaries
- Read-access restrictions may be bypassed for affected listings
- Sensitive application or user data could be disclosed
- Database integrity could be affected if the execution context permits additional query operations
- Further compromise could be possible depending on database privileges and exposed data
General mitigation guidance
Mitigation generally focuses on ensuring that persisted user-controlled values remain data throughout their entire lifecycle.
Common defensive patterns include:
- Use parameterized queries or safely bound query-builder parameters for all ACL conditions
- Avoid constructing SQL fragments through string concatenation
- Apply allowlist validation and canonicalization to account names according to application requirements
- Enforce strict schemas and length limits for identity fields
- Separate authorization decisions from dynamically assembled SQL expressions where practical
- Run the application database account with the minimum privileges required
- Review existing stored identities and other persisted inputs for unsafe reuse in query construction
How teams detect issues like this
Organizations can look for this vulnerability class through:
- Static analysis rules that flag string concatenation or interpolation within SQL statements
- Code review checks for persisted input flowing into query-building functions
- Tests using adversarial identity values against ACL-filtered views, without relying on production data
- Database monitoring for unexpected query shapes, anomalous
LIKEpredicates, and access to records outside normal authorization patterns - Policy enforcement requiring parameterized queries in application data-access layers
- Automated security review tools that track tainted data from registration or profile fields into database APIs
