The vulnerability is a classic second-order SQL injection in YesWiki's ApiController::deletePage() method. The API accepts arbitrary page tags via POST /api/pages/{tag}, storing them with proper escaping. However, when deleting a page, the stored tag is retrieved and directly interpolated into a DELETE SQL query without escaping, allowing injection. The deletePage method checks ownership and orphan status before executing the unescaped DELETE query on the links table. This flaw enables an authenticated low-privilege user to execute arbitrary SQL commands, including time-based blind data extraction, by crafting a malicious page tag and triggering the delete endpoint. Similar unescaped usage of the tag occurs in adjacent files but the API route is the easiest exploitation vector.

An authenticated low-privilege user can exploit this vulnerability to execute arbitrary SQL commands on the YesWiki database. This includes the ability to perform time-based blind SQL injection attacks to exfiltrate sensitive data from any accessible table. The vulnerability compromises confidentiality and integrity of the database and may cause partial denial of service due to injected queries. The impact is high given the ability to execute arbitrary SQL and extract data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API delete endpoint to trusted users only, or disable the API if possible. Avoid creating pages with untrusted tags and monitor for suspicious activity. Review and update the code to properly escape or parameterize SQL queries that use user-controlled data retrieved from the database. Do not rely solely on escaping at insert time; ensure all SQL query inputs are safely handled at every usage point.