Cve-2026-116207 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-116207/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 14:31:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgYesWiki: Unauthenticated SQL injection in SearchManager (CVE-2026-116207)https://feed.craftedsignal.io/briefs/2026-10-yeswiki-sql-injection/Sun, 25 Oct 2026 14:31:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-yeswiki-sql-injection/An unauthenticated SQL injection vulnerability in YesWiki versions 4.6.0-4.6.x and 5.0.0-alpha1-alpha3 allows remote attackers to perform subquery injection to extract database content or cause denial-of-service.YesWiki contains an unauthenticated SQL injection vulnerability in the SearchManager::prepareSearchRequest() method. The flaw stems from improper sanitization of field names within the Bazar entries search API. Specifically, the query and searchfields parameters are placed into backtick-quoted aliases using only mysqli_real_escape_string, which is insufficient for backtick encapsulation. This allows attackers to break out of the alias context and execute arbitrary SQL subqueries.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive database records, including user password hashes, or perform denial-of-service attacks by injecting time-based commands such as SLEEP().

Recommendation

  • Upgrade YesWiki to version 4.7.0 or 5.0.0-alpha4 or later to remediate the vulnerability.
  • Until patching is complete, restrict access to the public Bazar entries search API at the web application firewall or reverse proxy level.
  • Review web server access logs for anomalous requests to the Bazar search endpoint containing backtick characters (`) or SQL keywords commonly used for subquery injection (e.g., SELECT, UNION, SLEEP).
]]>criticaladvisoryweb-applicationsql-injectioncve-2026-116207cve-2026-116211