CyberRota Analysis
AI-GeneratedYesWiki versions prior to 4.6.7 are vulnerable to a cross-site request forgery (CSRF) flaw in the ajaxdeletepage handler, allowing attackers to delete arbitrary pages by tricking a logged-in administrator into clicking a malicious link. This vulnerability can lead to significant data loss, including the deletion of access control lists and associated content. Organizations using YesWiki should prioritize patching to mitigate the risk of unauthorized page deletions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.