https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 14:17:33 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-52771 <p>YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = &#39;$tag&#39; query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard {{include page=&#34;…&#34;}} link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table. This issue has been patched in version 4.6.6.</p> <p>YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = &#39;$tag&#39; query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard {{include page=&#34;…&#34;}} link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table. This issue has been patched in version 4.6.6.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-52771 https://vulnerability.circl.lu/vuln/ghsa-8f2v-2qhj-gfwg <p><strong>Affected:</strong> Packagist: yeswiki/yeswiki</p> <p>## Summary `ApiController::deletePage()` interpolates a page tag retrieved from the database into a `DELETE FROM …_links WHERE to_tag = &#39;$tag&#39;` query without escaping. The page tag is attacker-controlled — the `POST /api/pages/{tag}` API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard `{{include page=&#34;…&#34;}}` link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table.</p> <p>This is a **classic second-order SQL injection**: the `INSERT` correctly escapes the value, so the malicious tag is stored intact and the input passes every &#34;is this value safe to put in the database?&#34; check; the sink is the *read-back-and-reuse* path, where escaping is omitted.</p> <p>## Details ### Affected component</p> <p>* **File:** `includes/controllers/ApiController.php` * **Method:** `ApiController::deletePage($tag)` * **Route:** `@Route(&#34;/api/pages/{tag}&#34;, methods={&#34;DELETE&#34;}, options={&#34;acl&#34;:{&#34;+&#34;}})` — `acl:&#34;+&#34;` means *any authenticated user*. * **Sink:** line 626</p> <p>```php // includes/controllers/ApiController.php (v4.6.5 = origin/doryphore-dev HEAD, // lines 607–631) public function deletePage($tag) { $pageManager = $this-&gt;getService(PageManager::class); $pageController = $this-&gt;getService(PageController::class); $dbService = $th…</p> <p><strong>Affected:</strong> Packagist: yeswiki/yeswiki</p> <p>## Summary `ApiController::deletePage()` interpolates a page tag retrieved from the database into a `DELETE FROM …_links WHERE to_tag = &#39;$tag&#39;` query without escaping. The page tag is attacker-controlled — the `POST /api/pages/{tag}` API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard `{{include page=&#34;…&#34;}}` link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table.</p> <p>This is a **classic second-order SQL injection**: the `INSERT` correctly escapes the value, so the malicious tag is stored intact and the input passes every &#34;is this value safe to put in the database?&#34; check; the sink is the *read-back-and-reuse* path, where escaping is omitted.</p> <p>## Details ### Affected component</p> <p>* **File:** `includes/controllers/ApiController.php` * **Method:** `ApiController::deletePage($tag)` * **Route:** `@Route(&#34;/api/pages/{tag}&#34;, methods={&#34;DELETE&#34;}, options={&#34;acl&#34;:{&#34;+&#34;}})` — `acl:&#34;+&#34;` means *any authenticated user*. * **Sink:** line 626</p> <p>```php // includes/controllers/ApiController.php (v4.6.5 = origin/doryphore-dev HEAD, // lines 607–631) public function deletePage($tag) { $pageManager = $this-&gt;getService(PageManager::class); $pageController = $this-&gt;getService(PageController::class); $dbService = $th…</p> https://vulnerability.circl.lu/vuln/ghsa-8f2v-2qhj-gfwg