Detect YesWiki Formula Calculator Unsafe eval() Remote Code Execution (CVE-2026-52778) in Microsoft Sentinel
YesWiki prior to 4.6.6 exposes an unsafe PHP eval() call in its Formula Calculator feature (BazaR calculated field logic). An unauthenticated or low-privileged attacker can craft a malicious formula expression that is passed directly into eval(), resulting in arbitrary PHP code execution on the underlying web server, or a crafted expression that triggers resource exhaustion / infinite loops causing denial of service. Successful exploitation grants the attacker the privileges of the web server process, enabling webshell deployment, credential theft, and lateral movement.
MITRE ATT&CK
- Tactic
- Initial Access Execution Impact
KQL Detection Query
let SuspiciousPatterns = dynamic(["eval(", "system(", "exec(", "shell_exec", "passthru", "base64_decode", "assert("]);
AppServiceHTTPLogs
| where CsUriStem has_any ("/?BF_formula", "/index.php", "BazaR", "formulaire")
| where CsUriQuery has_any (SuspiciousPatterns) or CsUriStem has_any (SuspiciousPatterns)
| where ScStatus in (200, 500)
| project TimeGenerated, CIp, CsMethod, CsUriStem, CsUriQuery, ScStatus, sSiteName
| order by TimeGenerated descDetects HTTP requests to YesWiki endpoints containing formula/BazaR parameters with embedded PHP eval-style payload strings, indicative of CVE-2026-52778 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate BazaR formula fields that reference words like 'evaluate' in unrelated text content
- Security scanners actively testing for the vulnerability as part of authorized assessment
- Automated crawlers submitting malformed query strings unrelated to exploitation
Other platforms for CVE-2026-52778
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate malicious formula eval() payload submission
Expected signal: Web server access log entry showing POST to /?BazaR/formulaire with body containing 'eval(system(' string; PHP error log may show eval() execution or error
- Test 2Simulate DoS payload via infinite loop formula expression
Expected signal: Elevated CPU utilization on the web server host, PHP-FPM worker timeout/kill logs, web access log entry for the formula endpoint request
- Test 3Simulate webshell drop attempt post-exploitation
Expected signal: File creation event under the YesWiki webroot captured by FIM/EDR, web access log entry for the formula endpoint, PHP-FPM process spawning shell command
References (5)
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8
- https://nvd.nist.gov/vuln/detail/CVE-2026-52778
- https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52
- https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
- https://github.com/advisories/GHSA-px5m-h76g-p7p8
Response Playbook
Triage
- Confirm the target YesWiki instance version by checking /?BazaR or the composer.json/CHANGELOG for a version < 4.6.6, and verify the Formula Calculator feature is enabled on affected wiki pages
- Review web server access logs for requests to formula/BazaR endpoints containing PHP function call strings (eval, system, exec, base64_decode) to confirm exploitation attempts versus benign scanning
- Inspect the web server process list and recently modified files under the YesWiki webroot for unexpected PHP files, webshells, or modified core files indicating successful RCE
- Check for anomalous outbound connections or child processes spawned by the PHP-FPM/Apache/Nginx worker handling the YesWiki application
Containment
- Immediately apply the vendor patch by upgrading YesWiki to version 4.6.6 or later, or apply the fix from commit dd2bd8fb099de0d21504bda8a810693b3fcb8e52 if upgrade is not immediately possible
- Place a WAF rule or reverse proxy block on requests to formula/BazaR endpoints containing eval(), system(, exec(, base64_decode, or shell_exec strings until patching is complete
- Isolate the affected web server host from sensitive internal network segments if evidence of successful code execution is found, and rotate any credentials stored in configuration files accessible to the web process
- Disable the Formula Calculator / BazaR calculated field feature entirely as a temporary compensating control if patching cannot occur immediately
Evidence Collection
- Preserve web server access and error logs covering the suspected exploitation window, including full query strings and POST body payloads sent to formula endpoints
- Collect a forensic copy of the YesWiki webroot, including any newly created or recently modified PHP files, and compute file hashes for comparison against the official release
- Capture PHP-FPM/Apache/Nginx process execution history and system audit logs (auditd/EDR telemetry) showing any child processes spawned by the web server around the time of the suspicious requests
- Export any web application firewall or reverse proxy logs showing blocked or allowed requests matching the malicious formula payload pattern
Escalation Criteria
- !Escalate to incident response if forensic evidence confirms a webshell or unauthorized PHP file was written to the server, or if outbound connections to attacker-controlled infrastructure are observed
- !Escalate immediately if the affected YesWiki instance has access to sensitive internal systems, databases, or credentials that could enable lateral movement following successful RCE
- !Escalate if exploitation attempts are observed at scale (mass scanning) or originate from known malicious infrastructure, indicating active opportunistic campaign targeting this CVE
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access/error logs showing formula endpoint requests with embedded eval() payloads - >
Newly created or modified PHP files within the YesWiki webroot, especially outside standard plugin/theme directories - >
Process execution artifacts (EDR/auditd) showing child processes spawned from the PHP-FPM or Apache/Nginx worker - >
PHP error logs revealing eval() exceptions or parse errors from malformed exploitation attempts
Tuning Guidance
Baseline normal traffic volume and payload patterns to legitimate BazaR/formula endpoints in the environment before enabling blocking actions, since legitimate wiki editors regularly interact with these features. Exclude known internal vulnerability scanner IP ranges from alerting, and tune the eval()/system()/exec() string match list to reduce false positives from wiki content that legitimately discusses these terms in documentation pages. Prioritize alerts where suspicious payload strings appear directly within the formula/BazaR parameter value rather than elsewhere in the URL.
Hunting Queries
Hunts for IP addresses sending a high volume of distinct formula-related requests to YesWiki endpoints, indicative of automated fuzzing or mass exploitation attempts targeting CVE-2026-52778.
AppServiceHTTPLogs
| where CsUriStem has_any ("BazaR", "formulaire")
| summarize RequestCount=count(), DistinctPayloads=dcount(CsUriQuery) by CIp
| where RequestCount > 20
| order by RequestCount descindex=web (uri="*BazaR*" OR uri="*formulaire*")
| stats count dc(uri) as distinct_payloads by src_ip
| where count > 20
| sort -countAtomic Red Team Tests
Sends a crafted HTTP POST request to a lab YesWiki instance's BazaR formula field containing a PHP eval() injection payload to validate detection of exploitation attempts.
Command
curl -s -X POST 'http://lab-yeswiki.local/?BazaR/formulaire' --data 'formula=eval(system("id"))' -H 'Content-Type: application/x-www-form-urlencoded'Cleanup
No persistent changes made; verify no unexpected files were created under the YesWiki webroot with: find /var/www/yeswiki -mmin -5 -type fExpected Telemetry
Web server access log entry showing POST to /?BazaR/formulaire with body containing 'eval(system(' string; PHP error log may show eval() execution or error
Expected Detection
SIEM alert fires from the KQL/SPL/EQL rules matching formula endpoint with embedded eval/system payload strings
Submits a crafted formula expression designed to cause resource exhaustion via an unbounded loop inside the unsafe eval() call, testing denial-of-service detection.
Command
curl -s -X POST 'http://lab-yeswiki.local/?BazaR/formulaire' --data 'formula=eval("while(true){}")' -H 'Content-Type: application/x-www-form-urlencoded' --max-time 5Cleanup
Restart the PHP-FPM worker pool if CPU exhaustion persists: systemctl restart php-fpmExpected Telemetry
Elevated CPU utilization on the web server host, PHP-FPM worker timeout/kill logs, web access log entry for the formula endpoint request
Expected Detection
Detection rule flags the formula endpoint request containing 'eval(' payload; infrastructure monitoring alerts on abnormal CPU/process runtime
After simulating initial eval() code execution, attempts to write a test file to the webroot to validate detection of file-write artifacts consistent with webshell deployment.
Command
curl -s -X POST 'http://lab-yeswiki.local/?BazaR/formulaire' --data 'formula=eval(system("echo test123 > /var/www/yeswiki/tmp/test_artifact.php"))' -H 'Content-Type: application/x-www-form-urlencoded'Cleanup
rm -f /var/www/yeswiki/tmp/test_artifact.phpExpected Telemetry
File creation event under the YesWiki webroot captured by FIM/EDR, web access log entry for the formula endpoint, PHP-FPM process spawning shell command
Expected Detection
File integrity monitoring alert combined with SIEM correlation rule matching formula endpoint eval/system payload confirms successful exploitation chain