{"id":"CVE-2026-52775","aliases":["EUVD-2026-71807","GHSA-4pf7-cc4r-g63h"],"status":"published","title":"YesWiki Authenticated SQL Injection in ReactionManager","description":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00483,"percentile":0.4199,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-07-09T21:02:40Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"Packagist","package":"yeswiki/yeswiki","fixed_in":["4.6.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"yeswiki/yeswiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"yeswiki/yeswiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6"}]}],"versions":["4.2.3","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.2.0","v4.2.1","v4.2.2","v4.2.4","v4.3","v4.3.1","v4.4.0","v4.4.1","v4.4.2","v4.4.3","v4.4.4","v4.4.5","v4.5.0","v4.5.1","v4.5.2","v4.5.3","v4.5.4","v4.5.5","v4.6.0","v4.6.1","v4.6.2","v4.6.3","v4.6.4","v4.6.5"]}],"products":[{"vendor":"yeswiki","product":"yeswiki"}],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4pf7-cc4r-g63h","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/YesWiki/yeswiki/commit/90ca54fb518e1c43a1ead6e4f5bf9f0389789841","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-4pf7-cc4r-g63h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52775.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52775","tags":["advisory"]},{"url":"https://github.com/YesWiki/yeswiki","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-52775","title":"YesWiki Authenticated SQL Injection in ReactionManager","description":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.","status":"published","published":"2026-09-04T23:51:35.523Z","modified":"2026-09-08T18:05:15.099Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-71807","description":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.","status":"published","published":"2026-09-04T23:51:35Z","modified":"2026-09-08T18:05:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:28.557436Z"}],"ghsa":[{"id":"GHSA-4pf7-cc4r-g63h","title":"YesWiki has Authenticated SQL Injection via ReactionManager ","description":"## Summary\n\nYesWiki through the latest development branch contains a SQL injection vulnerability in `ReactionManager::deleteUserReaction()` that allows any authenticated user to inject arbitrary SQL via the `{idreaction}` and `{id}` URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.\n\nThis is a sibling of CVE-2026-46670 (unauthenticated SQLi in `FormManager::create()`). Both share the same root cause — raw string concatenation into SQL queries — but exist in different components.\n\n## Root Cause\n\n`includes/controllers/ApiController.php` line 726:\n```php\n/**\n * @Route(\"/api/reactions/{idreaction}/{id}/{page}/{username}\", methods={\"DELETE\"}, options={\"acl\":{\"+\"}})\n */\n```\n\nACL `\"+\"` = any authenticated user. Parameters flow into `ReactionManager::deleteUserReaction()` → `TripleStore::delete()` with raw string concatenation into SQL LIKE clause (line 356).\n\nThe `if` branch (lines 340-354) properly uses `$this-\u003edbService-\u003eescape()`. The `else` branch does not — the developer applied escaping to one code path but not the other.\n\n## PoC\n\n```\nDELETE /wiki/?api/reactions/x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker\nHost: localhost:8085\nCookie: \u003csession cookie\u003e\n```\n\nTime-based blind variant via `{id}` parameter for data exfiltration.\n\n## Impact\n\nFull database read/write. Any self-registered user can extract `yeswiki_users` password hashes and emails.\n\n## Suggested Fix\n\nApply `$this-\u003edbService-\u003eescape()` to all parameters in the `else` branch, matching the `if` branch pattern. Also audit all `TripleStore::delete()` callers that pass `$extraSQL`.\n\n## Credits\n\nKai Aizen / SnailSploit","status":"published","published":"2026-07-09T21:02:40Z","modified":"2026-07-09T21:02:42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:41.501474Z"}],"nvd":[{"id":"CVE-2026-52775","description":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.","status":"published","published":"2026-09-05T00:17:20.52Z","modified":"2026-09-08T21:05:26.92Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"CVE-2026-52775","title":"YesWiki Authenticated SQL Injection in ReactionManager","description":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.","status":"published","published":"2026-09-04T23:51:35.523Z","modified":"2026-10-28T02:30:26.881909498Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"GHSA-4pf7-cc4r-g63h","title":"YesWiki has Authenticated SQL Injection via ReactionManager ","description":"## Summary\n\nYesWiki through the latest development branch contains a SQL injection vulnerability in `ReactionManager::deleteUserReaction()` that allows any authenticated user to inject arbitrary SQL via the `{idreaction}` and `{id}` URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.\n\nThis is a sibling of CVE-2026-46670 (unauthenticated SQLi in `FormManager::create()`). Both share the same root cause — raw string concatenation into SQL queries — but exist in different components.\n\n## Root Cause\n\n`includes/controllers/ApiController.php` line 726:\n```php\n/**\n * @Route(\"/api/reactions/{idreaction}/{id}/{page}/{username}\", methods={\"DELETE\"}, options={\"acl\":{\"+\"}})\n */\n```\n\nACL `\"+\"` = any authenticated user. Parameters flow into `ReactionManager::deleteUserReaction()` → `TripleStore::delete()` with raw string concatenation into SQL LIKE clause (line 356).\n\nThe `if` branch (lines 340-354) properly uses `$this-\u003edbService-\u003eescape()`. The `else` branch does not — the developer applied escaping to one code path but not the other.\n\n## PoC\n\n```\nDELETE /wiki/?api/reactions/x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker\nHost: localhost:8085\nCookie: \u003csession cookie\u003e\n```\n\nTime-based blind variant via `{id}` parameter for data exfiltration.\n\n## Impact\n\nFull database read/write. Any self-registered user can extract `yeswiki_users` password hashes and emails.\n\n## Suggested Fix\n\nApply `$this-\u003edbService-\u003eescape()` to all parameters in the `else` branch, matching the `if` branch pattern. Also audit all `TripleStore::delete()` callers that pass `$extraSQL`.\n\n## Credits\n\nKai Aizen / SnailSploit","status":"published","published":"2026-07-09T21:02:40Z","modified":"2026-07-09T21:26:42.185557Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}