Summary
YesWiki versions 4.5.0 through before 4.7.0 contain an SQL injection flaw in the PageManager::save() operation. An unauthenticated attacker on a default installation may manipulate the date_maj_fiche field to execute a database query and potentially exfiltrate password hashes from the wiki_users table.
YesWiki versions 4.5.0 through before 4.7.0 contain an SQL injection flaw in the PageManager::save() operation. An unauthenticated attacker on a default installation may manipulate the date_maj_fiche field to execute a database query and potentially exfiltrate password hashes from the wiki_users table.
Affected context
The vulnerability occurs in YesWiki's Bazar entry-creation workflow when the date_maj_fiche request field is incorporated into an INSERT statement without adequate escaping or parameterization. Deployments may be exposed when this workflow is reachable without authentication and database queries are constructed from attacker-influenced request data.
The vulnerability occurs in YesWiki's Bazar entry-creation workflow when the date_maj_fiche request field is incorporated into an INSERT statement without adequate escaping or parameterization. Deployments may be exposed when this workflow is reachable without authentication and database queries are constructed from attacker-influenced request data.
Exploit preconditions
- Attack surface: The Bazar entry-creation request handled by PageManager::save()
- Required access: Network access to the affected YesWiki workflow; authentication may not be required on default installations
- Trigger point: Processing the date_maj_fiche field during database insertion
- Why exploitation is possible: The field is concatenated into SQL without safe parameter binding, allowing crafted input to alter the intended query
- Attack surface: The Bazar entry-creation request handled by PageManager::save()
- Required access: Network access to the affected YesWiki workflow; authentication may not be required on default installations
- Trigger point: Processing the date_maj_fiche field during database insertion
- Why exploitation is possible: The field is concatenated into SQL without safe parameter binding, allowing crafted input to alter the intended query
Why this happens
The underlying flaw is a failure to separate SQL code from untrusted request data. PageManager::save() concatenates the date_maj_fiche value into an INSERT statement rather than consistently using parameterized queries or an equivalent safe database abstraction. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
The underlying flaw is a failure to separate SQL code from untrusted request data. PageManager::save() concatenates the date_maj_fiche value into an INSERT statement rather than consistently using parameterized queries or an equivalent safe database abstraction. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
Potential impact
- An attacker may read unauthorized records from the YesWiki database
- Password hashes from the wiki_users table could be exfiltrated
- Database contents could be modified or corrupted
- Application integrity and user confidentiality could be compromised
- The database account's permissions could increase the scope of possible damage
- An attacker may read unauthorized records from the YesWiki database
- Password hashes from the wiki_users table could be exfiltrated
- Database contents could be modified or corrupted
- Application integrity and user confidentiality could be compromised
- The database account's permissions could increase the scope of possible damage
General mitigation guidance
Mitigation generally centers on eliminating dynamic SQL construction from request-derived values.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every database value
- Apply strict server-side type and format validation to date fields
- Treat client-provided dates as untrusted even when the application expects a fixed format
- Restrict database accounts to the minimum permissions required by the application
- Avoid exposing sensitive authentication data through application queries or error responses
- Add regression tests that verify malformed and unexpected field values cannot alter query structure
Mitigation generally centers on eliminating dynamic SQL construction from request-derived values.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every database value
- Apply strict server-side type and format validation to date fields
- Treat client-provided dates as untrusted even when the application expects a fixed format
- Restrict database accounts to the minimum permissions required by the application
- Avoid exposing sensitive authentication data through application queries or error responses
- Add regression tests that verify malformed and unexpected field values cannot alter query structure
How teams detect issues like this
Organizations can look for this vulnerability through:
- Static analysis rules that identify string concatenation or interpolation in SQL statements
- Code review checks for request parameters reaching database APIs without parameter binding
- Runtime monitoring for unusual SQL syntax, error patterns, or access to authentication tables
- Web application firewall policies that flag injection-oriented input, while recognizing that filtering is not a substitute for safe query construction
- Automated security testing of unauthenticated entry-creation workflows using structured input validation and database-query monitoring
Organizations can look for this vulnerability through:
- Static analysis rules that identify string concatenation or interpolation in SQL statements
- Code review checks for request parameters reaching database APIs without parameter binding
- Runtime monitoring for unusual SQL syntax, error patterns, or access to authentication tables
- Web application firewall policies that flag injection-oriented input, while recognizing that filtering is not a substitute for safe query construction
- Automated security testing of unauthenticated entry-creation workflows using structured input validation and database-query monitoring
