PT-2022-11777 · Yeswiki · Yeswiki

Published 2022-03-25 · Updated 2022-03-29 · CVE-2021-43091

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yeswiki versions prior to 4.1.0

Description An SQL Injection issue exists in Yeswiki via the email parameter in the registration form.

Recommendations For versions prior to 4.1.0, update to version 4.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the registration form until the update is applied. Avoid using the email parameter in the affected registration form until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-43091

GHSA-XGX2-332H-9X6Q

Affected Products

Yeswiki

References · 7

• 🔥 https://huntr.dev/bounties/07f245a7-ee9f-4b55-a0cc-13d5cb1be6e0 · Exploit
• https://github.com/yeswiki/yeswiki/commit/c9785f9a92744c3475f9676a0d8f95de24750094 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43091 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43091 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xgx2-332h-9x6q · Vendor Advisory
• https://github.com/yeswiki/yeswiki · Note
• https://t.me/cibsecurity/39543 · Telegram Post