Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided security advisory and the associated patch commit clearly points to a SQL injection vulnerability within the buildQueriesConditions function of the SearchManager class. The vulnerability description explicitly identifies this function as the sink where the unvalidated, attacker-controlled input from the query or queries GET parameters is used to construct a SQL query. The provided patch f3b0dd093a7ace47dc29a515faeb02635baceae2 confirms this by modifying the exact same function. The patch removes the vulnerable line that directly concatenates the escaped, but unvalidated, numeric value into the SQL string. It replaces this with a proper validation check using is_numeric and is_finite, and then casts the value to a float. This ensures that only legitimate numeric values can be part of the query, thus mitigating the SQL injection risk. The call chain starts from public API endpoints in ApiController, goes through BazarListService::getEntries and SearchManager::search, but the core of the vulnerability lies in how the SQL WHERE clause is constructed within SearchManager.buildQueriesConditions.
SearchManager.buildQueriesConditionstools/bazar/services/SearchManager.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yeswiki/yeswiki | composer | < 4.6.6 | 4.6.6 |