CVE-2026-104457

Summary

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (…) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.

Affected Software

Weaknesses

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

References

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-p87r-f4x4-8r4g
• https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-sql-injection-via-filtertags-filtern-parameter

• ←Previous
• Next→