CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to 3.7.3 are critically vulnerable to SQL injection through the fullTextSearchAssetContent endpoint, which can be accessed by unauthenticated users. This flaw allows attackers to execute arbitrary SQL commands on the read-write asset-content database, potentially leading to unauthorized access, modification, or deletion of data across notebooks. Organizations using affected versions should prioritize immediate patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.