YesWiki Bazar Search API SQL Injection Vulnerability

YesWiki is affected by an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest().

Versions 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 are impacted. Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string.

• Attackers can supply a backtick to inject subqueries.
• This can read data such as user password hashes.
• It can also exhaust database threads with SLEEP().