Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-52778.
Upgrade to ProDetect YesWiki Formula Calculator Unsafe eval() Remote Code Execution (CVE-2026-52778) in Microsoft Sentinel
YesWiki prior to 4.6.6 exposes an unsafe PHP eval() call in its Formula Calculator feature (BazaR calculated field logic). An unauthenticated or low-privileged attacker can craft a malicious formula expression that is passed directly into eval(), resulting in arbitrary PHP code execution on the underlying web server, or a crafted expression that triggers resource exhaustion / infinite loops causing denial of service. Successful exploitation grants the attacker the privileges of the web server process, enabling webshell deployment, credential theft, and lateral movement.
MITRE ATT&CK
- Tactic
- Initial Access Execution Impact
KQL Detection Query
let SuspiciousPatterns = dynamic(["eval(", "system(", "exec(", "shell_exec", "passthru", "base64_decode", "assert("]);
AppServiceHTTPLogs
| where CsUriStem has_any ("/?BF_formula", "/index.php", "BazaR", "formulaire")
| where CsUriQuery has_any (SuspiciousPatterns) or CsUriStem has_any (SuspiciousPatterns)
| where ScStatus in (200, 500)
| project TimeGenerated, CIp, CsMethod, CsUriStem, CsUriQuery, ScStatus, sSiteName
| order by TimeGenerated descDetects HTTP requests to YesWiki endpoints containing formula/BazaR parameters with embedded PHP eval-style payload strings, indicative of CVE-2026-52778 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate BazaR formula fields that reference words like 'evaluate' in unrelated text content
- Security scanners actively testing for the vulnerability as part of authorized assessment
- Automated crawlers submitting malformed query strings unrelated to exploitation
Other platforms for CVE-2026-52778
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate malicious formula eval() payload submission
Expected signal: Web server access log entry showing POST to /?BazaR/formulaire with body containing 'eval(system(' string; PHP error log may show eval() execution or error
- Test 2Simulate DoS payload via infinite loop formula expression
Expected signal: Elevated CPU utilization on the web server host, PHP-FPM worker timeout/kill logs, web access log entry for the formula endpoint request
- Test 3Simulate webshell drop attempt post-exploitation
Expected signal: File creation event under the YesWiki webroot captured by FIM/EDR, web access log entry for the formula endpoint, PHP-FPM process spawning shell command
References (5)
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8
- https://nvd.nist.gov/vuln/detail/CVE-2026-52778
- https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52
- https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
- https://github.com/advisories/GHSA-px5m-h76g-p7p8
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-52778 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month