CVE-2026-116207: Critical YesWiki SQL Injection in Bazar Search API — Detection and Remediation Guide

On the surface this looks like another routine injection bug. It is not. CVE-2026-116207 (CVSS 9.1, CRITICAL) is an unauthenticated, network-exploitable SQL injection in YesWiki — the open-source PHP/MySQL wiki and collaborative platform — specifically in SearchManager::prepareSearchRequest(), reachable through the public Bazar entries search API. No credentials, no session token, no user interaction required. Anyone who can reach the search endpoint can read arbitrary data out of the underlying MySQL database, including user password hashes, or weaponize SLEEP() to exhaust database threads and take the application down.

The National Vulnerability Database flags the vulnerable pathway as NETWORK, and the affected versions are YesWiki 4.6.0 up to (but not including) 4.7.0, and 5.0.0-alpha1 up to (but not including) 5.0.0-alpha4. If your organization — or any client you manage — runs YesWiki in that range, treat this as an emergency change. Public-facing collaborative platforms like YesWiki are frequently internet-exposed by design, which means the attack surface here is essentially "anyone on the internet with curl."

In my experience, unauthenticated injection flaws in low-profile PHP applications are exactly the class of vulnerability that gets folded into mass scanning within days of disclosure. They are cheap to exploit, easy to fingerprint, and often sit on servers with weak monitoring. This post covers the technical mechanics, concrete detection content for your SOC, and a verified remediation path.

Technical Analysis

Affected Products and Versions

The vulnerable component interacts with MySQL via mysqli — this is why NVD's categorization references the MySQL data path. Any YesWiki deployment backed by MySQL/MariaDB in the affected version range is exposed.

Root Cause: How the Injection Works

The flaw lives in SearchManager::prepareSearchRequest(). The Bazar search API accepts query and searchfields parameters. Field names derived from those parameters are concatenated into SQL as backtick-quoted aliases/identifiers — and the only sanitization applied is mysqli_real_escape_string().

That is the entire bug, and it is a classic one: mysqli_real_escape_string() escapes string literals (quotes, null bytes, newlines, backslashes). It does not escape backticks. When attacker-controlled input is placed inside backticks — MySQL's identifier quoting — the correct defense is to strip or double backticks, or better, whitelist field names against a known schema. Because neither happens here, an attacker simply supplies a backtick (`) inside a field name to break out of the identifier context and inject arbitrary SQL — typically stacked into subqueries.

Two practical exploitation outcomes defenders should plan for:

1. Data exfiltration — injected subqueries can read any table the application's database user can reach. The advisory explicitly calls out user password hashes. Even if YesWiki's own user table is the primary target, shared database credentials and overly broad grants are common in LAMP deployments, so assume lateral database access.
2. Denial of service — SLEEP()-based payloads injected into subqueries burn database worker threads. Enough concurrent requests and the MySQL thread pool saturates, taking the wiki (and anything sharing that database server) offline. Time-based payloads are also the standard vehicle for blind extraction when query results are not reflected in the response, so expect attackers to use SLEEP() for data theft as well as DoS.

Exploitation Requirements and Status

• Authentication: None. The Bazar search API is public.
• Complexity: Low. This is a single-parameter injection requiring nothing more than a crafted GET/POST request with a backtick and a subquery.
• Prerequisites: Network reachability to the YesWiki web application.

As of publication, the vulnerability is documented in NVD (CVE-2026-116207) with a CVSS 9.1 rating. At time of writing there is no confirmed CISA KEV listing, but given the trivial exploitability, unauthenticated reach, and the abundance of internet-facing YesWiki instances (widely used by European civic tech, cooperatives, and community organizations), defenders should operate on the assumption that scanning and exploitation attempts are imminent or already underway. Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116207) and CISA KEV daily until patched.

Why This Pattern Matters Beyond YesWiki

The "escaped string placed in an identifier context" mistake is one of the most persistent injection anti-patterns in PHP/MySQL codebases. If you run other PHP applications that build dynamic ORDER BY clauses, column selectors, or aliased subqueries from user input, audit them with the same lens: escaping functions built for string literals provide zero protection inside backticks.

Detection & Response

The good news: this vulnerability is highly detectable. Backticks in HTTP request parameters, SLEEP( in URLs or bodies, and anomalous request volumes against the Bazar search endpoint are all strong, low-noise signals. Below are production-ready detections. Tune paths to your deployment (the Bazar search route is typically under the YesWiki base path — verify against your access logs).

---
title: YesWiki Bazar Search SQL Injection Attempt via Backtick in Parameters
id: 3f9c1a72-5d84-4b6e-9a21-7c4e8f0b2d35
status: experimental
description: Detects exploitation attempts against CVE-2026-116207 by identifying backtick characters (raw or URL-encoded %60) in query/searchfields parameters sent to the YesWiki Bazar search API. Backticks in these parameters have no legitimate use and indicate identifier-context breakout attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-116207
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/06/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'searchfields=%60'
      - 'searchfields=' 
      - 'query=%60'
      - '%60'
  selection_params:
    cs-uri-query|contains:
      - 'searchfields='
      - 'query='
  condition: selection_params and selection_uri
falsepositives:
  - Extremely rare; backticks are not valid in normal Bazar search field names
level: high
---
title: SQL Time-Based Payload (SLEEP) in Web Request Targeting YesWiki
id: 8b2e4d61-1a93-4f57-bc68-2e9d5a7c3f41
status: experimental
description: Detects SLEEP() and common blind SQLi functions (BENCHMARK) in web request URIs or bodies targeting YesWiki paths. Time-based payloads are used both for denial of service via thread exhaustion and for blind data extraction in CVE-2026-116207 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-116207
  - https://attack.mitre.org/techniques/T1498/
author: Security Arsenal
date: 2026/06/09
tags:
  - attack.initial_access
  - attack.t1190
  - attack.impact
  - attack.t1498
logsource:
  category: webserver
detection:
  selection_payload:
    cs-uri-query|contains:
      - 'sleep('
      - 'SLEEP('
      - 'benchmark('
      - 'BENCHMARK('
      - 'sleep%28'
      - 'SLEEP%28'
  selection_path:
    cs-uri-stem|contains:
      - 'Bazar'
      - 'bazar'
      - 'search'
  condition: selection_payload and selection_path
falsepositives:
  - Security scanners and authorized penetration tests
level: critical
---
title: Anomalous Request Volume to YesWiki Bazar Search Endpoint
id: c47d2f19-6e35-48a1-bd94-1f6b3e8a5c27
status: experimental
description: Detects a single source issuing an abnormally high number of requests to the YesWiki Bazar search endpoint within a short window, consistent with automated blind SQL injection extraction or SLEEP-based thread exhaustion against CVE-2026-116207.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-116207
author: Security Arsenal
date: 2026/06/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - 'Bazar'
      - 'bazar'
  condition: selection | count(c-ip) by cs-uri-stem > 100
 timeframe: 5m
falsepositives:
  - Legitimate search crawlers; baseline normal traffic first and exclude known indexer user agents
level: medium

// Hunt: CVE-2026-116207 exploitation attempts against YesWiki Bazar search API
// Ingest Apache/Nginx logs into Sentinel via CEF/Syslog or the HTTP Custom Logs connector.
// Looks for backticks (raw or %60) and time-based SQLi payloads in search requests.
let timeframe = 7d;
let sqli_patterns = dynamic(["%60", "`", "sleep(", "SLEEP(", "sleep%28", "benchmark(", "BENCHMARK("]);
CommonSecurityLog
| where TimeGenerated > ago(timeframe)
| where RequestURL has_any ("Bazar", "bazar", "search")
    or AdditionalExtensions has "searchfields"
| extend ReqStr = strcat(RequestURL, " ", tostring(AdditionalExtensions))
| where ReqStr has_any (sqli_patterns)
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, ApplicationProtocol, DeviceAction, ReqStr
| sort by TimeGenerated desc;
// Companion hunt: request-volume anomaly per source against Bazar search (blind extraction / DoS)
let window = 5m;
CommonSecurityLog
| where TimeGenerated > ago(1d)
| where RequestURL has_any ("Bazar", "bazar") and RequestURL has "search"
| summarize RequestCount = count(), DistinctParams = dcount(RequestURL) by SourceIP, bin(TimeGenerated, window)
| where RequestCount > 100
| sort by RequestCount desc;

-- Hunt YesWiki SQLi exploitation artifacts in web access logs on Linux hosts
-- Deploy as a Velociraptor hunt across your web tier. Adjust the log glob to your distro/layout.
LET logs = SELECT FullPath FROM glob(globs=['/var/log/apache2/*access*.log', '/var/log/nginx/*access*.log', '/var/log/httpd/*access*.log'])

SELECT FullPath AS LogFile, Line
FROM foreach(row=logs,
query={
  SELECT FullPath, Line
  FROM parse_lines(filename=FullPath, buffer_size=1048576)
  WHERE Line =~ 'Bazar|bazar|searchfields'
    AND (Line =~ '%60|`|sleep%28|SLEEP%28|sleep\\(|SLEEP\\(|benchmark\\(|BENCHMARK\\(')
})
ORDER BY LogFile

#!/bin/bash
# CVE-2026-116207 - YesWiki SQLi: verify version, hunt access logs, confirm patch state
# Run on the YesWiki web host. Tested for Debian/Ubuntu layouts; adjust paths as needed.

set -u

YESWIKI_ROOT="${1:-/var/www/html}"
LOG_DIRS="/var/log/apache2 /var/log/nginx /var/log/httpd"

echo "=== [1] Installed YesWiki version ==="
if [ -f "$YESWIKI_ROOT/includes/constants.php" ]; then
  grep -i "yeswiki_version\|YESWIKI_RELEASE\|version" "$YESWIKI_ROOT/includes/constants.php" | head -5
elif [ -f "$YESWIKI_ROOT/composer.json" ]; then
  grep -i '"version"' "$YESWIKI_ROOT/composer.json"
else
  echo "[!] Could not locate YesWiki version file under $YESWIKI_ROOT - check your docroot."
fi

echo ""
echo "=== [2] Hunt access logs for exploitation indicators (backtick / %60 / SLEEP / BENCHMARK) ==="
for d in $LOG_DIRS; do
  if [ -d "$d" ]; then
    echo "--- Scanning $d ---"
    zgrep -hEi 'Bazar|bazar|searchfields' "$d"/*access*.log* 2>/dev/null \
      | grep -Ei '%60|`|sleep%28|sleep\(|SLEEP\(|benchmark\(|BENCHMARK\(' \
      | awk '{print $1, $7}' | sort | uniq -c | sort -rn | head -20
  fi
done

echo ""
echo "=== [3] Top requesters against Bazar search (last logs available) ==="
for d in $LOG_DIRS; do
  if [ -d "$d" ]; then
    zgrep -hEi 'Bazar|bazar' "$d"/*access*.log* 2>/dev/null \
      | grep -i 'search' | awk '{print $1}' | sort | uniq -c | sort -rn | head -10
  fi
done

echo ""
echo "=== [4] Quick WAF/mitigation snippet (if patch cannot be applied immediately) ==="
cat <<'EOF'
# ModSecurity example - block backticks and time-based payloads in search params
SecRule ARGS "@rx (?i)(`|%60|sleep\s*\(|benchmark\s*\()" \
  "id:900001,phase:2,deny,status:403,log,msg:'CVE-2026-116207 YesWiki SQLi attempt blocked'"

# nginx example - rate limit the search endpoint while you patch
# limit_req_zone $binary_remote_addr zone=sqli_hunt:10m rate=10r/m;
# location ~* (Bazar|bazar).*search { limit_req zone=sqli_hunt burst=5 nodelay; }
EOF

echo ""
echo "[!] REMEDIATION: Upgrade YesWiki to 4.7.0 (stable) or 5.0.0-alpha4 (alpha branch)."
echo "[!] See: https://nvd.nist.gov/vuln/detail/CVE-2026-116207"

Remediation

1. Patch Immediately — This Is the Only Complete Fix

• Stable branch: upgrade to YesWiki 4.7.0 or later.
• Alpha branch: upgrade to 5.0.0-alpha4 or later.
• Pull the release from the official YesWiki project repository and verify checksums before deployment. Back up the database and the wakka.config.php / custom theme directories before upgrading, then validate the Bazar search functionality post-upgrade.

Given the CVSS 9.1 severity, unauthenticated reach, and public exploit pathway, treat this with the same urgency you would a KEV-listed flaw: emergency change window within 24–72 hours for internet-facing instances, and check CISA KEV daily for a listing that would impose formal deadlines (24 hours for internet-facing under typical emergency directives, 7 days under standard KEV timelines for federal-scope environments — apply the same discipline internally).

2. If You Cannot Patch Today — Compensating Controls

• WAF rule: block requests to the Bazar search route where query or searchfields parameters contain backticks (raw or %60), SLEEP(, or BENCHMARK(. Sample ModSecurity and nginx configurations are in the script above. This is a stopgap — WAF evasion is a matter of time, not possibility.
• Restrict the endpoint: if your YesWiki instance does not require public Bazar search, temporarily disable or ACL the search route at the reverse proxy.
• Rate limiting: aggressive per-IP rate limits on the search endpoint blunt both blind extraction (which requires thousands of requests) and SLEEP() thread exhaustion.
• Network segmentation: if the instance is internal-only, confirm it is not accidentally exposed — check NAT rules, CDN origins, and cloud security groups.

3. Database Hardening (Defense in Depth — Do Regardless of Patching)

• Least-privilege DB account: the MySQL user YesWiki runs under should have only the grants it needs on its own schema — no FILE, no cross-schema reads. This directly limits what a successful injection can steal.
• Rotate credentials: if log review shows any exploitation indicators (Section 2 of the script above), assume compromise. Rotate all YesWiki user passwords (hashes may have been exfiltrated), the application's database credentials, and any secrets stored in the wiki. Force password resets.
• Review password hash strength: confirm YesWiki is using a modern hashing scheme; if leaked hashes are weak (MD5/SHA1 era), treat cracking as trivial and prioritize the reset.

4. Post-Incident Validation

• Run the access-log hunts above across at least 30–90 days of retained logs (extend to whatever retention you have — injection reconnaissance often precedes disclosure).
• Check MySQL general/slow query logs for anomalous long-running queries consistent with SLEEP() abuse.
• Review wiki user tables for unexpected administrator accounts and audit content pages for injected links or webshell droppers.
• If any indicator hits, escalate to a full IR engagement: preserve logs and disk images before remediation actions overwrite evidence.

5. Strategic Fixes for Your PHP Estate

Use this incident as a forcing function to audit other PHP applications that build SQL identifiers from user input (dynamic ORDER BY, column pickers, report builders). The rule is simple and absolute: user input selects from a server-side whitelist of field names — it is never concatenated into SQL, escaped or not.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub