An unauthenticated SQL injection vulnerability in YesWiki allows remote attackers to extract sensitive data, including user password hashes, from the underlying database.

The vulnerability exists in the Bazar form-import path within the FormManager::create() function. It permits an unauthenticated visitor to inject malicious SQL into an INSERT statement, resulting in unauthorized database access.

The ability to perform unauthenticated SQL injection constitutes a critical threat to data confidentiality and integrity. With a CVSS score of 9.8, this vulnerability allows attackers to dump the entire database, including authentication credentials, which could lead to widespread system compromise and severe reputational damage.

Immediate Action: Update YesWiki to version 4.6.4 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor database query logs for anomalous activity or unexpected syntax errors that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to block malicious payloads targeting the form-import path.

Public Exploit Available: No (unknown).

Given the ease of exploitation and the severity of potential data loss, immediate patching is required. All administrators of YesWiki installations must upgrade to version 4.6.4 to eliminate this critical SQL injection vector.