YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.

YesWiki, a PHP-based wiki system, contains a SQL injection vulnerability in the ReactionManager::deleteUserReaction() function affecting all versions prior to 4.6.6. Any authenticated user can exploit this flaw by injecting arbitrary SQL through the {idreaction} and {id} URL path parameters. The vulnerability arises because these parameters are concatenated directly into a SQL LIKE clause without proper escaping or parameterization. This represents a significant security risk as it requires only authenticated access, not administrative privileges. The issue affects YesWiki through its latest development branch at the time of disclosure. A patch has been released in version 4.6.6. Users are strongly advised to upgrade immediately. The fix is documented in a GitHub commit and an associated security advisory. No workaround is described; upgrading to 4.6.6 is the recommended remediation.