YesWiki Formula Calculator Unsafe eval() Remote Code Execution (CVE-2026-52778)

let SuspiciousPatterns = dynamic(["eval(", "system(", "exec(", "shell_exec", "passthru", "base64_decode", "assert("]);
AppServiceHTTPLogs
| where CsUriStem has_any ("/?BF_formula", "/index.php", "BazaR", "formulaire")
| where CsUriQuery has_any (SuspiciousPatterns) or CsUriStem has_any (SuspiciousPatterns)
| where ScStatus in (200, 500)
| project TimeGenerated, CIp, CsMethod, CsUriStem, CsUriQuery, ScStatus, sSiteName
| order by TimeGenerated desc

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
(uri="*BF_formula*" OR uri="*BazaR*" OR uri="*formulaire*")
| regex uri="(?i)(eval\(|system\(|exec\(|shell_exec|passthru|base64_decode|assert\()"
| stats count by src_ip, uri, status, _time
| where count > 0
| sort -_time

any where event.dataset == "nginx.access" and
  (url.original : "*BF_formula*" or url.original : "*BazaR*" or url.original : "*formulaire*") and
  (url.original : "*eval(*" or url.original : "*system(*" or url.original : "*exec(*" or url.original : "*base64_decode*" or url.original : "*shell_exec*")

SELECT sourceip, destinationip, "URL", eventtime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Apache%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%Nginx%'
AND ("URL" ILIKE '%BF_formula%' OR "URL" ILIKE '%BazaR%' OR "URL" ILIKE '%formulaire%')
AND ("URL" ILIKE '%eval(%' OR "URL" ILIKE '%system(%' OR "URL" ILIKE '%exec(%' OR "URL" ILIKE '%base64_decode%')
LAST 24 HOURS

_sourceCategory=Web/Access
| where uri matches "*BF_formula*" or uri matches "*BazaR*" or uri matches "*formulaire*"
| where uri matches "*eval(*" or uri matches "*system(*" or uri matches "*exec(*" or uri matches "*base64_decode*"
| count by src_ip, uri, status_code
| sort -_count

rule yeswiki_formula_eval_rce
{
  meta:
    author = "df00tech"
    description = "Detects exploitation attempts against YesWiki CVE-2026-52778 unsafe eval() in Formula Calculator"
    severity = "CRITICAL"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.url = /(BF_formula|BazaR|formulaire)/ nocase
    $http.target.url = /(eval\(|system\(|exec\(|base64_decode|shell_exec)/ nocase

  condition:
    $http
}

#event_simple_name=HttpRequestArtifact
| RequestURI=/*BF_formula*/i OR RequestURI=/*BazaR*/i OR RequestURI=/*formulaire*/i
| RequestURI=/*eval\(*|*system\(*|*exec\(*|*base64_decode*/i
| table([ClientIP, RequestURI, ResponseCode, timestamp])