YesWiki vulnerabilities

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. An attacker can craft a link whose field value breaks out of the ajax-mail-form action attribute, executing JavaScript in the victim's browser.

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile. SVG files are stored verbatim and served inline as image/svg+xml, allowing authenticated users to upload SVG files containing script that executes in the wiki origin when opened.

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. An attacker can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.

YesWiki prior to version 4.6.6 contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication.

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archived revision, and execute arbitrary JavaScript in the victim's browser. The vulnerable form is only rendered when the victim can both read and edit the target page.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders.

YesWiki from version 4.2.0 to before 4.6.6 has a SQL injection vulnerability in ApiController::deletePage(), where a page tag retrieved from the database is interpolated into a DELETE query without escaping. A low-privilege authenticated user can create a page with a tag that is a SQL fragment and execute arbitrary SQL in the wiki database.

YesWiki prior to version 4.6.6 has an unauthenticated SQL injection vulnerability in public Bazar entry-listing APIs, in numeric query filters. The filter value is escaped but inserted into SQL without quotes or numeric validation, allowing an attacker to inject boolean expressions and infer database contents.

YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in the POST /api/forms/{formId}/actor/inbox route, which is publicly exposed. HttpSignatureService::verifySignature() parses the HTTP Signature header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification. An unauthenticated attacker can make the server issue requests to internal services, including cloud metadata.

YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in HttpSignatureService::verifySignature(), which checks the result of openssl_verify() with a loose boolean negation. Since PHP treats -1 as truthy, the condition !(-1) is false, causing the error to be skipped and processing to continue even when signature verification failed.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page.

YesWiki prior to version 4.6.6 contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template field, which are executed server-side when public semantic endpoints are requested.

In YesWiki prior to version 4.6.0, a stored and blind XSS vulnerability was found in the form title field. An unauthenticated attacker can inject JavaScript that executes when other users visit the page.

A Cross Site Scripting (XSS) vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload in the meta configuration robots field.