YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validation. An unauthenticated attacker can inject boolean SQL expressions and infer database contents from whether entries are returned. This issue has been patched in version 4.6.6.

YesWiki, a PHP-based wiki system, contains an unauthenticated SQL injection vulnerability in its public Bazar entry-listing APIs prior to version 4.6.6. The flaw exists in numeric query and queries filters where attacker-controlled filter values are escaped but inserted into SQL queries without quotes or numeric validation. This allows unauthenticated attackers to inject boolean SQL expressions and perform blind SQL injection to infer database contents based on whether entries are returned. No authentication is required to exploit this vulnerability, making it accessible to any remote attacker. The vulnerability affects the Bazar module's field handling for numeric value structures. A patch has been released in YesWiki version 4.6.6, which addresses the improper SQL construction. Users are advised to upgrade to version 4.6.6 or later to mitigate the risk of database enumeration and potential data exfiltration.