Threats tagged 'ghsa-qg78-vmvc-fhjw'

YesWiki versions prior to 4.6.6 have an unauthenticated SQL injection vulnerability in the public Bazar entry-listing APIs. The issue arises because numeric query filters are escaped but not properly validated or quoted, allowing attackers to inject boolean SQL expressions. This can lead to unauthorized inference of database contents via crafted queries. The vulnerability affects numeric Bazar fields such as number, range, and map latitude/longitude fields. No known exploits in the wild have been reported.