An unauthenticated SQL injection vulnerability in YesWiki versions prior to 4.6.6 allows remote attackers to exfiltrate sensitive database information.

The application fails to properly validate or quote numeric query filters within the Bazar entry-listing API, permitting unauthenticated attackers to execute arbitrary SQL queries. By leveraging boolean-based inference, an attacker can extract data from the underlying database without requiring administrative credentials.

The vulnerability carries a CVSS score of 7.5, classifying it as a high-severity risk due to the potential for unauthorized data disclosure. Successful exploitation could lead to the exposure of sensitive wiki content, user information, or configuration details, potentially resulting in significant reputational damage and the compromise of proprietary information stored within the system.

Immediate Action: Update the YesWiki installation to version 4.6.6 or later to incorporate the necessary input validation fixes.

Proactive Monitoring: Review web server and application access logs for unusual patterns, specifically looking for SQL syntax characters or boolean logic sequences within API request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns, which can provide temporary protection while the update process is scheduled.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the ease of exploitation for unauthenticated actors, this vulnerability presents a significant risk to data confidentiality. Administrators should prioritize the deployment of the 4.6.6 update immediately to eliminate the injection vector and secure the application against potential data exfiltration attempts.