YesWiki is a PHP‑based wiki platform. Prior to version 4.6.1, its bazar module contains a classic SQL injection flaw in EntryManager.php. The id_fiche value extracted directly from $_POST['id_fiche'] is concatenated into a raw SQL statement without sanitization or parameterization. Based on the description, it is inferred that an attacker could manipulate the query to read, modify, or delete arbitrary data in the database, compromising confidentiality and integrity.

All installations of YesWiki using the bazar module with a version earlier than 4.6.1 are vulnerable. The flaw resides in tools/bazar/services/EntryManager.php and was patched in release 4.6.1.

The vulnerability has a CVSS base score of 8.8, indicating high severity. No EPSS score has been reported, so its current exploitation probability is unknown. It is not listed in the CISA KEV catalog. Attackers must authenticate to the website and have write access to the bazar module to submit a crafted POST request containing the malicious id_fiche value. Based on typical usage, it is inferred that authentication is required to reach the affected code path, but once reached, the attacker can compromise the database integrity and expose sensitive content.