Threats tagged 'ghsa-8f2v-2qhj-gfwg'

YesWiki versions 4.2.0 through 4.6.5 contain a second-order SQL injection vulnerability in the ApiController::deletePage() method. An authenticated low-privilege user can create a page with a malicious tag containing SQL code, which is stored safely but later used unescaped in a DELETE SQL query. This allows execution of arbitrary SQL commands in the wiki database, including time-based blind data exfiltration. The vulnerability arises because the page tag is read back from the database and interpolated into a SQL query without proper escaping. Exploitation requires three steps: planting the malicious tag, making the page non-orphaned via an include directive, and invoking the delete API endpoint. No official patch information is provided.