Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

YAF.NET admin page lets low‑privilege users run SQL

CVE-2026-43937 · published 5 months ago
Summary

In YAF.NET versions before 4.0.5, a low‑privilege user could access the admin RunSql page and cause the system to execute any SQL commands they supplied. This could let an attacker read, change, or delete data in the forum database. Update YAF.NET to version 4.0.5 or later to close the gap.

What to do
  • Update ingo herbote yafnet.core to version 4.0.5.
Affected software
Ecosystem VendorProductAffected versions
nuget ingo herbote yafnet.core <= 4.0.4
Fix: upgrade to 4.0.5
Original advisory text
YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and passes it straight to IDbAccess.RunSql with no caller check, yielding arbitrary SQL execution for any low-privileged user. This vulnerability is fixed in 4.0.5.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
CWE-841Improper Enforcement of Behavioral Workflow
Timeline
Published12 May 2026
Updated4 Nov 2026
First seen5 May 2026
Sources
GHSA-xhw7-j96h-c3g5 · GHSA
CVE-2026-43937 · NVD
CVE-2026-43937 · OSV
Track software like this
Free during beta