An SQL injection vulnerability in YesWiki prior to version 4.6.1 allows authenticated users to compromise the underlying database, presenting severe confidentiality, integrity, and availability risks.

This is an SQL Injection vulnerability (CWE-89) located in the bazar module file tools/bazar/services/EntryManager.php at line 704, where the $data['id_fiche'] parameter is concatenated directly into a raw SQL query without parameterization, requiring low privileges and no user interaction.

A successful exploitation of this vulnerability could grant an attacker full read and write access to the application database, potentially leading to unauthorized data modification, sensitive data exfiltration, or complete system compromise. The CVSS score of 8.8 reflects the high severity of the potential impact, highlighting significant operational and security risks for organizations utilizing vulnerable instances.

Immediate Action: Update YesWiki to version 4.6.1 or later where the SQL injection flaw has been patched.

Proactive Monitoring: Monitor database query logs for unusual or malformed SQL statements originating from the bazar module services.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block suspicious SQL injection patterns targeting the bazar module input parameters.

Public Exploit Available: No - There is no confirmed public exploit in the available data.

Given the high CVSS score of 8.8 and the availability of a proof-of-concept, organizations running YesWiki must prioritize patching immediately. Administrators should apply version 4.6.1 or later without delay to eliminate the underlying SQL injection vector and protect sensitive database contents from unauthorized access.