Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-52778.

Upgrade to Pro
CVE-2026-52778 IBM QRadar · QRadar

Detect YesWiki Formula Calculator Unsafe eval() Remote Code Execution (CVE-2026-52778) in IBM QRadar

YesWiki prior to 4.6.6 exposes an unsafe PHP eval() call in its Formula Calculator feature (BazaR calculated field logic). An unauthenticated or low-privileged attacker can craft a malicious formula expression that is passed directly into eval(), resulting in arbitrary PHP code execution on the underlying web server, or a crafted expression that triggers resource exhaustion / infinite loops causing denial of service. Successful exploitation grants the attacker the privileges of the web server process, enabling webshell deployment, credential theft, and lateral movement.

MITRE ATT&CK

Tactic
Initial Access Execution Impact

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, "URL", eventtime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Apache%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%Nginx%'
AND ("URL" ILIKE '%BF_formula%' OR "URL" ILIKE '%BazaR%' OR "URL" ILIKE '%formulaire%')
AND ("URL" ILIKE '%eval(%' OR "URL" ILIKE '%system(%' OR "URL" ILIKE '%exec(%' OR "URL" ILIKE '%base64_decode%')
LAST 24 HOURS
critical severity medium confidence

Flags web log events where requests to YesWiki formula endpoints include embedded PHP code execution function calls, consistent with CVE-2026-52778.

Data Sources

Web Server LogsQRadar Log Source: Apache/Nginx

Required Tables

events

False Positives & Tuning

  • Scheduled authorized security assessments
  • Non-malicious formula content mentioning function names as plain text
  • Proxy replay of cached benign requests

Other platforms for CVE-2026-52778

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate malicious formula eval() payload submission

    Expected signal: Web server access log entry showing POST to /?BazaR/formulaire with body containing 'eval(system(' string; PHP error log may show eval() execution or error

  2. Test 2Simulate DoS payload via infinite loop formula expression

    Expected signal: Elevated CPU utilization on the web server host, PHP-FPM worker timeout/kill logs, web access log entry for the formula endpoint request

  3. Test 3Simulate webshell drop attempt post-exploitation

    Expected signal: File creation event under the YesWiki webroot captured by FIM/EDR, web access log entry for the formula endpoint, PHP-FPM process spawning shell command

Last updated: 2026-07-25 Research depth: standard
References (5)

Unlock playbooks & atomic tests with Pro

Get the full detection package for CVE-2026-52778 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0040Impact

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections