CVE-2026-52770: YesWiki Bazar API SQL Injection Vulnerability

CVE-2026-52770 Overview

CVE-2026-52770 is an unauthenticated SQL injection vulnerability in YesWiki, a PHP-based wiki system. The flaw affects the public Bazar entry-listing APIs prior to version 4.6.6. YesWiki escapes attacker-controlled filter values for numeric Bazar fields but inserts them into SQL statements without quotes or numeric validation. An unauthenticated attacker can inject boolean SQL expressions into the query or queries filter parameters. Attackers use blind boolean-based inference to extract database contents by observing whether entries are returned. The maintainers patched the issue in YesWiki version 4.6.6. The vulnerability is classified as improper neutralization of special elements used in an SQL command [CWE-89].

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents through blind SQL injection against public Bazar endpoints, exposing configuration data, user records, and wiki content.

Affected Products

YesWiki versions prior to 4.6.6
YesWiki Bazar entry-listing APIs with numeric field filters
Any public-facing YesWiki instance exposing Bazar query endpoints

Discovery Timeline

2026-09-05 - CVE-2026-52770 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52770

Vulnerability Analysis

The vulnerability resides in tools/bazar/services/SearchManager.php within the numeric filter branch of the Bazar search logic. When a Bazar field descriptor has _type_ set to number, YesWiki constructs a CAST(... AS DOUBLE) comparison against the user-supplied filter value. The code applies mysqli_real_escape_string to the value but does not enclose it in quotes and does not validate that the input is actually numeric. Because mysqli_real_escape_string only escapes string delimiters and control characters, it provides no protection when the value is placed directly into a SQL expression as a numeric literal. Attackers submit crafted filter payloads that break out of the numeric context and inject arbitrary boolean SQL expressions.

Root Cause

The root cause is reliance on string-escaping for a non-string SQL context. The pre-patch code path built comparisons like CAST(field AS DOUBLE) = <user_value> without numeric validation, allowing arbitrary SQL fragments to be concatenated in place of a numeric literal.

Attack Vector

The attack requires no authentication and is exploitable over the network against the public Bazar entry-listing APIs. An attacker submits crafted query or queries filter parameters targeting fields typed as number. The injected boolean expressions cause conditional inclusion or exclusion of results, enabling classic blind SQL injection to enumerate database contents one bit at a time.

php

// Patched code from tools/bazar/services/SearchManager.php
// Source: https://github.com/YesWiki/yeswiki/commit/f3b0dd093a7ace47dc29a515faeb02635baceae2
else {
    if ($vDescriptor['_type_'] == 'number') {
        if (isset($vValue) && trim($vValue) !== '') {
            if (!is_numeric(trim($vValue)) || !is_finite((float) trim($vValue))) {
                $vValueConditions[] = 'FALSE';
            } else {
                $vValueConditions[] = 'CAST(' . mysqli_real_escape_string($this->wiki->dblink, $this->renameJSONPathVariable($vFieldName)) . ' AS DOUBLE) ' . $vComparisonOperator . ' ' . (float) trim($vValue);
            }
        } else {
            $vValueConditions[] = '(' . mysqli_real_escape_string($this->wiki->dblink, $this->renameJSONPathVariable($vFieldName)) . ' COLLATE ' . $this->dbService->getCollation() . ' ' . $vComparisonOperator . ' \'\' )';
        }
    }
}

The patch adds is_numeric and is_finite validation, forces non-numeric inputs to evaluate as FALSE, and casts valid values to float before concatenation. See the YesWiki patch commit for the full diff.

Detection Methods for CVE-2026-52770

Indicators of Compromise

HTTP requests to Bazar entry-listing endpoints containing SQL keywords such as SELECT, UNION, SLEEP, BENCHMARK, or boolean expressions like AND 1=1 in query or queries parameters.
Repeated requests to the same Bazar endpoint with incrementally changing numeric filter values, indicative of automated blind SQLi enumeration.
Web server access logs showing unusually long or URL-encoded values for numeric field filters.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect Bazar API parameters for SQL metacharacters, comment sequences (--, #), and boolean tautologies.
Correlate MySQL slow-query logs with application access logs to identify anomalous CAST(... AS DOUBLE) queries containing non-numeric fragments.
Alert on high-volume, low-variance requests from a single source against ?action=bazarliste, ?action=bazarcarto, and related Bazar endpoints.

Monitoring Recommendations

Enable MySQL general query logging on YesWiki database instances during triage to capture SQL fragments produced by injection attempts.
Monitor outbound network activity from the web server for signs of data exfiltration following suspected exploitation.
Track version strings served by public YesWiki deployments to identify hosts still running versions below 4.6.6.

How to Mitigate CVE-2026-52770

Immediate Actions Required

Upgrade all YesWiki instances to version 4.6.6 or later without delay.
Audit database accounts used by YesWiki and rotate credentials if exploitation is suspected.
Review web server logs for prior requests to Bazar endpoints containing SQL syntax in numeric filters.

Patch Information

The fix is contained in YesWiki release v4.6.6. Additional context is available in the GitHub Security Advisory GHSA-qg78-vmvc-fhjw. The patch adds is_numeric and is_finite validation in SearchManager.php and casts validated input to float before embedding it in SQL.

Workarounds

If immediate upgrade is not possible, restrict access to Bazar entry-listing endpoints via authentication, IP allowlisting, or reverse-proxy rules.
Deploy WAF signatures that reject requests containing SQL keywords in query and queries parameters targeting Bazar endpoints.
Grant the YesWiki database user only the minimum privileges required, limiting the impact of successful injection.

bash

# Example nginx rule blocking obvious SQLi patterns in Bazar query parameters
location ~* /\?.*action=bazar(liste|carto|table) {
    if ($args ~* "(union|select|sleep\(|benchmark\(|--|/\*)") {
        return 403;
    }
    proxy_pass http://yeswiki_backend;
}