YesWiki versions prior to 4.6.7 allow unauthenticated blind SQL injection through the {{newtextsearch}} action because option identifiers from Bazar lists are concatenated directly into REGEXP/LIKE clauses without escaping. This flaw lets an anonymous attacker insert a malicious option id into an anonymously editable Bazar list and then use search requests as a boolean oracle to retrieve arbitrary data from the database. In particular, the vulnerability can expose sensitive information such as admin password hashes stored in the yeswiki_users table, compromising both confidentiality and integrity of the site's data. The impact is therefore a potential data breach and credential exposure, with no direct code execution demonstrated but a high potential for escalating privileges if privileges are extracted from database blobs.

The affected product is YesWiki, an open‑source wiki platform. Any instance running a version earlier than 4.6.7 is vulnerable. Since no specific sub‑versions are listed, all releases prior to 4.6.7 are considered at risk.

The CVSS score of 8.7 reflects high severity. EPSS information is not provided, so the likelihood of exploitation cannot be quantified, though the absence of a known public exploit and the unavailability of an EPSS score do not diminish the inherent risk posed by an unauthenticated, blind SQL injection vectored through a common user feature. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed active exploitation. Attackers can target the site with simple HTTP search queries, making the exploitation path straightforward for the unauthenticated attacker.