CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.8.4 are vulnerable to a SQL injection flaw in the graph query endpoint, allowing unauthenticated attackers to exploit the dailyNoteSavePath parameter. This vulnerability enables attackers to execute arbitrary SQL queries, potentially extracting sensitive data from all notebooks on sites where authentication is disabled. Organizations using SiYuan should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.