CVE-2026-46670: 
PHP vulnerability analysis and mitigation

CVE-2026-46670 is an unauthenticated SQL injection vulnerability in YesWiki, a PHP-based wiki system, affecting the Bazar form-import path via FormManager::create(). It allows any unauthenticated visitor to inject arbitrary SQL into an INSERT statement and read the full database, including yeswiki_users.password hashes. All versions prior to 4.6.4 are affected, including 4.6.1, 4.6.2, and the doryphore-dev branch. The vulnerability was published on May 22, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, YesWiki Advisory).

The root cause is CWE-89 (SQL Injection) — specifically, the unquoted concatenation of the user-supplied bn_id_nature parameter directly into an INSERT VALUES SQL statement within FormManager::create() at tools/bazar/services/FormManager.php (line 258). The vulnerable code constructs the query as VALUES ( . $data['bn_id_nature'] . , "fr-FR", "', allowing an attacker to embed arbitrary SQL expressions. The injection is exploitable via a POST request to /?BazaR&vue=formulaire with a crafted imported-form parameter containing a blind arithmetic-based SQL subquery (e.g., 7330000 + ASCII(SUBSTRING((SELECT HEX(CONCAT(email,0x3a,password)) FROM yeswiki_users LIMIT 1),1,1))). The inserted row's bn_id_nature value encodes one character of the exfiltrated data, which is then read back via the /?api/forms endpoint, enabling character-by-character database extraction with no authentication required (YesWiki Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to dump the entire YesWiki database, including usernames, email addresses, and hashed passwords from the yeswiki_users table. Recovered password hashes could be cracked offline and reused for account takeover or lateral movement if credentials are shared across services. The vulnerability also carries high integrity and availability impact scores, indicating potential for data modification or disruption of the wiki service (GitHub Advisory).

A proof-of-concept exploit script (yeswiki_sqli_poc.py) was included in the original security advisory and is publicly documented, demonstrating full database extraction via blind SQL injection (YesWiki Advisory). The NVD SSVC assessment classifies exploitation as "poc" and the attack as automatable with total technical impact (Feedly). A Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository (v10.4.4), further lowering the barrier to exploitation. The EPSS score is approximately 0.04% per Feedly data, and there is no evidence of active in-the-wild exploitation or CISA KEV listing at this time. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing YesWiki instances running versions prior to 4.6.4 using search engines (Shodan, Censys) or by checking the YesWiki version page.
2. Confirm vulnerability: Verify the target exposes the Bazar form-import endpoint by sending a benign POST request to /?BazaR&vue=formulaire and confirming a valid response.
3. Craft injection payload: Construct a POST body with the imported-form parameter key set to a SQL arithmetic expression, e.g.:

   imported-form[7330000+ASCII(SUBSTRING((SELECT HEX(CONCAT(email,0x3a,password)) FROM yeswiki_users LIMIT 1),1,1))]={"bn_label_nature": "zz_poc", "bn_template": "", "bn_description": "", "bn_condition": ""}

4. Send the request: Submit the crafted POST request to /?BazaR&vue=formulaire. MySQL evaluates the embedded SQL expression and stores the result as the bn_id_nature value in the yeswiki_nature table.
5. Read back the result: Query /?api/forms to retrieve the newly inserted form's bn_id_nature value, subtract the base offset (e.g., 7330000), and convert the result back to an ASCII character.
6. Iterate: Repeat steps 3–5, incrementing the SUBSTRING position index to extract each character of the target data (e.g., hex-encoded email and password hash).
7. Decode and crack: Reassemble the hex-encoded string, decode it to obtain plaintext email and hashed password, then attempt offline hash cracking for credential reuse (YesWiki Advisory, GitHub Advisory).

• Network: Repeated POST requests to /?BazaR&vue=formulaire with URL-encoded SQL expressions in the imported-form parameter key (e.g., containing ASCII, SUBSTRING, SELECT, HEX, yeswiki_users).
• Network: Subsequent GET requests to /?api/forms from the same source IP shortly after each POST, consistent with automated data extraction.
• Logs: Web server access logs showing high-frequency POST/GET pairs to the above endpoints from a single IP or small IP range, with unusual numeric values in the imported-form parameter key.
• Database: Presence of unexpected rows in the yeswiki_nature table with large numeric bn_id_nature values (e.g., in the 7,000,000+ range) and label names matching patterns like zz_poc_*.
• Application Logs: YesWiki or PHP error logs showing SQL errors or unexpected INSERT statements involving arithmetic expressions in the bn_id_nature field (YesWiki Advisory).

Upgrade YesWiki to version 4.6.4 or later, which fixes the SQL injection by properly sanitizing or parameterizing the bn_id_nature input in FormManager::create() (GitHub Advisory). As an interim measure, restrict network access to the /?BazaR&vue=formulaire endpoint (e.g., via WAF rules blocking SQL keywords in POST body parameter names) and implement input validation enforcing numeric-only values for bn_id_nature. Given the exposure of password hashes, administrators should also rotate all user passwords as a precautionary measure after patching (Feedly).

The vulnerability was reported by security researcher SamyGhannad and published by YesWiki maintainer mrflos via GitHub Security Advisories on May 22, 2026 (YesWiki Advisory). A Nuclei detection template was subsequently added to the ProjectDiscovery nuclei-templates repository in release v10.4.4, indicating community interest in automated detection. No significant broader media coverage or notable social media discussion beyond standard vulnerability aggregator listings has been observed.