Technical impact
YesWiki 4.5.0 through 4.6.x contain an unsanitized SQL statement in PageManager::save(). When a new Bazar entry is created, the date_maj_fiche field is concatenated directly into an INSERT query, allowing an attacker to inject arbitrary SQL, including sub‑selects that retrieve sensitive data from the wiki_users table. The resulting breach provides unauthorized access to password hashes and other credentials, illustrating a classic CWE‑89 SQL Injection flaw.
Affected Systems
The vulnerable product is YesWiki 4.5.0 to 4.6.x, which users run on the default installation. The flaw exists in the page manager that manages Bazar form submissions and is fixed in version 4.7.0 and later.
Risk and Exploitability
The CVSS base score of 8.8 indicates a high severity. Although the EPSS score is not available, the flaw is exploitable by unauthenticated users who have access to the Bazar entry creation endpoint, a feature that is typically exposed by default. The exploit requires only a crafted HTTP request, making it straightforward for a remote attacker with network access. The vulnerability is not listed in the CISA KEV catalog, so no public exploits are recorded, but the lack of mitigation leaves systems vulnerable to credential theft.
