YesWiki's archived revision view reflects the 'time' GET parameter into a hidden input field in handlers/page/show.php without escaping, leading to a reflected XSS vulnerability. The 'time' parameter is used to load a specific archived revision by matching a DATETIME value in the database. MySQL's coercion of malformed DATETIME strings allows an attacker to append HTML/JavaScript to a valid timestamp, which still matches an archived revision row. The vulnerable code path is only triggered if the victim has both read and write access to the page, as the edit form for archived revisions is rendered only under these conditions. The vulnerability was validated on YesWiki doryphore 4.6.5. The reflected payload executes in the victim's browser when the crafted URL is visited, demonstrating improper neutralization of input during web page generation (CWE-80).

An attacker can execute arbitrary JavaScript in the context of the victim's browser by injecting a crafted payload into the 'time' parameter. This reflected XSS can lead to session hijacking, credential theft, or other malicious actions within the victim's privileges on the YesWiki instance. Exploitation requires the victim to have read and write access to the target page, which may be available to authenticated users or, in some default configurations, even anonymous users on public editable pages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to trusted users only and avoid configurations that allow anonymous editing of public pages. Review and sanitize user input in the 'time' parameter before rendering it in HTML contexts, ideally applying proper escaping such as htmlspecialchars() to prevent XSS. Monitor vendor channels for updates and apply official patches once released.