A SQL injection vulnerability in YesWiki versions 4.2.0 through 4.6.5 allows authenticated attackers to execute arbitrary database commands and potentially exfiltrate sensitive information.

This vulnerability is an SQL injection flaw occurring in the ApiController::deletePage function, where user-controlled page tags are improperly sanitized before being used in a database query. A low-privilege authenticated user can exploit this by injecting crafted SQL fragments into page tags to perform unauthorized database operations.

The ability to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity, as an attacker could perform time-based blind exfiltration of sensitive information from any database table. Given the CVSS score of 8.3, this high-severity vulnerability could lead to significant data breaches, unauthorized access to system records, and potential disruption of wiki services.

Immediate Action: Upgrade your YesWiki installation to version 4.6.6 or later, which includes the necessary security patches to prevent SQL injection.

Proactive Monitoring: Review application access logs for anomalous POST requests to the /api/pages/ endpoint and monitor database query logs for unusual syntax or extended execution times indicative of blind SQL injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming web requests.

Public Exploit Available: No

Organizations utilizing YesWiki should prioritize the update to version 4.6.6 as part of their standard patch management cycle. Failure to address this vulnerability leaves the wiki database exposed to unauthorized access and data theft; therefore, immediate application of the vendor-provided security update is strongly recommended.