Attack Chain

1. An unauthenticated attacker sends a crafted HTTP POST request to the /?BazaR&vue=formulaire endpoint.
2. The request contains a specially crafted imported-form parameter with SQL injection payload.
3. The FormManager::create() function (FormManager.php#L258) processes the request and concatenates the malicious input into an SQL INSERT statement without proper sanitization.
4. The injected SQL code executes within the context of the YesWiki database.
5. The attacker uses the SQL injection to extract data from the yeswiki_users table, including email addresses and password hashes.
6. The extracted data is encoded and embedded within the bn_id_nature field of a newly created database entry.
7. The attacker then sends a request to /?api/forms to retrieve the bn_id_nature field.
8. The attacker decodes the extracted data to obtain sensitive information, such as usernames, emails, and password hashes.

Impact

Successful exploitation of this vulnerability (CVE-2026-46670) allows an unauthenticated attacker to dump the entire YesWiki database. This includes sensitive information such as usernames, email addresses, and, most critically, hashed passwords of all users. This complete data breach can lead to account compromise, unauthorized access to sensitive wiki content, and potential lateral movement within the organization if users reuse passwords across multiple services. The impact is particularly severe given the ease of exploitation.

Recommendation

• Upgrade YesWiki to version 4.6.4 or later to patch the SQL injection vulnerability in FormManager::create() (reference: GHSA-jwvv-qr7q-cv8j).
• Deploy the Sigma rule “Detect YesWiki Unauthenticated SQL Injection Attempt” to detect exploitation attempts against the vulnerable endpoint.
• Monitor web server logs for POST requests to /?BazaR&vue=formulaire with suspicious characters in the imported-form parameter (reference: sample HTTP request in the content).
• Apply the Sigma rule “Detect YesWiki Data Exfiltration via API” to detect attempts to retrieve encoded data using the /?api/forms endpoint after successful SQL injection.