XWiki, Blind SQL Injection, CVE-2025-32969 (Critical)

How the CVE Works

CVE-2025-32969 is a critical blind SQL injection vulnerability in XWiki versions 1.8 through 15.10.15, 16.4.5, and 16.10.0. The flaw allows unauthenticated attackers to bypass HQL (Hibernate Query Language) restrictions and inject malicious SQL queries directly into the database backend. Due to improper input sanitization, attackers can manipulate query execution, enabling data exfiltration (e.g., password hashes) or destructive operations (INSERT/UPDATE/DELETE). The vulnerability persists even when security settings like “Prevent unregistered users from viewing/editing pages” are enabled. Exploitation relies on crafting malicious requests that escape the HQL context, leveraging database-specific syntax to execute arbitrary SQL.

DailyCVE Form

Platform: XWiki
Version: 1.8 – 15.10.15, 16.4.5, 16.10.0
Vulnerability: Blind SQL Injection
Severity: Critical
Date: 04/30/2025

What Undercode Say:

Exploitation

1. Recon: Identify XWiki version via `/xwiki/bin/view/Main/WebHome`.

Payload Crafting: Use HQL escape sequences like `’) OR 1=1–` to bypass filters.

Blind Exfiltration: Time-based or error-based techniques for data extraction.

-- Time-based example (MySQL)
SELECT IF(SUBSTRING(password,1,1)='a',SLEEP(5),0) FROM xwikiusers;

Protection

Patch: Upgrade to XWiki 15.10.16, 16.4.6, or 16.10.1.
WAF Rules: Block HQL-specific syntax (e.g., ', --, ;).
Database Hardening: Restrict XWiki DB user permissions to SELECT-only.

Detection Commands

Check XWiki version (curl)
curl -s http://target/xwiki/bin/view/Main/WebHome | grep "xwiki.version"
Log analysis for HQL errors
grep -i "hql.exception" /var/log/xwiki/xwiki.log

Mitigation Script (Temporary)

// Disable HQL in xwiki.cfg
hql.query.enabled = false