CyberRota Analysis
AI-GeneratedYesWiki versions prior to 4.6.4 are vulnerable to an unauthenticated SQL injection in the Bazar form-import path, allowing attackers to execute arbitrary SQL commands and access sensitive data, including user password hashes. This critical vulnerability poses a significant risk to any organization using a default installation of YesWiki, as it can lead to unauthorized data exposure. Organizations running affected versions should prioritize immediate updates to version 4.6.4 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.