Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yeswiki/yeswiki | composer | >= 4.2.0, < 4.6.6 | 4.6.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is a second-order SQL injection in YesWiki. The core of the issue lies in the fact that user-provided page tags are stored in the database without sanitization and are later used in SQL queries without proper escaping. The analysis of the provided patch 23d3cc124613b9428ab963b31807c08879a9c631 confirms this. The patch applies escaping to the $tag variable in three different locations where it is used in SQL queries. The primary and most easily exploitable vulnerable function is ApiController::deletePage, where a DELETE query is constructed with the unescaped tag. The other two locations, handlers/page/deletepage.php and tools/tags/handlers/page/__deletepage.php, present the same vulnerability pattern in different contexts, one in a SELECT query and the other in a DELETE query. An attacker can create a page with a malicious tag, and when this page is deleted or handled by the other vulnerable scripts, the malicious SQL in the tag gets executed.
ApiController::deletePageincludes/controllers/ApiController.php
handlers/page/deletepage.phphandlers/page/deletepage.php
tools/tags/handlers/page/__deletepage.phptools/tags/handlers/page/__deletepage.php