## https://sploitus.com/exploit?id=007FF93E-4149-567D-912B-B01843EA7F4B
# CVE-2026-69083 — SiYuan Unauthenticated SQL Injection
Unauthenticated SQL injection in [SiYuan](https://github.com/siyuan-note/siyuan) (a Go-based
knowledge-base app) via the asset-content search endpoint.
`POST /api/search/fullTextSearchAssetContent` builds a raw SQL statement by concatenating the
user-controlled `query` value straight into a REGEXP clause with no escaping
(`kernel/model/asset_content.go`, `assetContentFieldRegexp`):
```
SELECT * FROM `asset_contents_fts_case_insensitive`
WHERE (name REGEXP '' OR content REGEXP '') AND ext IN
```
A single quote in `query` breaks out of the string literal (**CWE-89**). When SiYuan is deployed
without an access-auth code (`Conf.AccessAuthCode == ""`), the whole kernel treats callers as
administrator with no credentials, so the injection is fully **unauthenticated**. `method:3` is
the REGEXP break-out; `method:2` additionally passes `query` as a raw SQL statement.
- **Affected:** SiYuan `` — which is
otherwise a **syntax error** when `types` is empty (SiYuan emits `AND ext IN ` with nothing
after it, and the kernel silently returns no rows on a SQL error).
The endpoint then returns every row of the asset-content index, and the tool prints each row's
`content`.
## Identifying a target
```bash
curl -s http://10.10.10.10:6806/system_stats # or browse http://10.10.10.10:6806/ (no login prompt)
```
A SiYuan instance on port 6806 that loads without an access-auth code is exploitable.
## Remediation
- **SiYuan ≥ 3.7.3** parameterizes the REGEXP query (`... REGEXP ?`) and gates the method-2
raw-SQL path behind an administrator check.
- Always run SiYuan with an `--accessAuthCode`; never expose it unauthenticated — with no
access-auth code the entire kernel API is administrator-open.
- Do not store plaintext credentials in indexed notes/assets.
## Disclaimer
For authorized security testing and education only. Use it only against systems you own or have
explicit permission to test.