YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data['id_fiche'] value (sourced from $_POST['id_fiche']) is concatenated directly into a raw SQL query without any sanitization or parameterization. This issue has been patched in version 4.6.1.

Affected: Packagist: yeswiki/yeswiki

## Vulnerability Details

YesWiki bazar module contains a SQL injection vulnerability in `tools/bazar/services/EntryManager.php` at line 704. The `$data['id_fiche']` value (sourced from `$_POST['id_fiche']`) is concatenated directly into a raw SQL query without any sanitization or parameterization.

**Vulnerable Code (EntryManager.php:704):** ```php $result = $this->dbService->loadSingle( 'SELECT MIN(time) as firsttime FROM ' . $this->dbService->prefixTable('pages') . "WHERE tag='" . $data['id_fiche'] . "'" ); ```

**Attack Path:** 1. Attacker authenticates as any user (route requires `acl:{"+"}`) 2. POST `/api/entries/{formId}` with `id_fiche=' OR SLEEP(3) OR '` 3. `ApiController::createEntry()` checks `isEntry($_POST['id_fiche'])` → false (not existing entry) → calls `create()` 4. `create()` → `formatDataBeforeSave()` → SQL injection at line 704

**`dbService->loadSingle()` passes raw string to `mysqli_query()` with no escaping. The `escape()` method exists but is NOT called here.**

**Docker PoC confirmation:** - Normal query: `SELECT MIN(time) as firsttime FROM wiki_pages WHERE tag='TestEntry'` → `2024-01-01 00:00:00` - Injected: `WHERE tag='' OR SLEEP(3) OR ''` → **elapsed: 3.00s (SLEEP confirmed)** - Time-based blind SQLi enables full database dump via binary search

## Steps to Reproduce

**Prerequisites:** Any authenticated user account on a YesWiki instance with a bazar form (id_typeannonce) created.

**Step 1 – Obtain session cookie** (standard login via we…