YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`

published 2026-05-05 6 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-29479 , GHSA-xhw7-j96h-c3g5

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and passes it straight to IDbAccess.RunSql with no caller check, yielding arbitrary SQL execution for any low-privileged user. This vulnerability is fixed in 4.0.5.

Patch / fix

fixed in 2 links 2

nuget YAFNET.Core 4.0.5
yetanotherforum yaf.net 4.0.5

github.com/YAFNET/YAFNET@27f7e67 commit
github.com/YAFNET/YAFNET/releases/tag/v4.0.5 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 5 mo ago (2026-05-12)

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/YAFNET/YAFNET/security/advisories/GHSA-xhw7-j96h-c3g5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
nuget	YAFNET.Core	<4.0.5	4.0.5

Affected products

YAFNET YAFNET

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command
CWE-841 Improper Enforcement of Behavioral Workflow

References

github.com /YAFNET/YAFNET/commit/27f7e671f93698f7e014d5d0fb88320248b8aa20
web
github.com /YAFNET/YAFNET/security/advisories/GHSA-xhw7-j96h-c3g5
exploit, web
nvd.nist.gov /vuln/detail/CVE-2026-43937
advisory
github.com /YAFNET/YAFNET
package
github.com /YAFNET/YAFNET/releases/tag/v4.0.5
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary