Listen to this Post
The SQL injection vulnerability in XWiki Full Calendar Macro stems from improper input sanitization in the Calendar.JSONService page. This service handles user-provided parameters for fetching calendar data, such as event filters or date ranges, and directly incorporates them into SQL queries without using parameterized statements or adequate validation. An attacker with view rights on this page, including guest users, can craft malicious HTTP requests containing SQL commands in the parameters. When processed, these commands are concatenated into the SQL query and executed by the database. For example, by injecting UNION SELECT clauses, an attacker can exfiltrate sensitive database information like user credentials or application configuration. Alternatively, using heavy queries or time-based delays, the attacker can initiate a Denial-of-Service (DoS) attack by consuming excessive database resources, potentially crashing the service. The vulnerability is critical due to the low privilege requirement—only view rights—which are often granted to public users, enabling remote exploitation. The lack of prepared statements or output encoding allows arbitrary SQL execution under the database user’s privileges, risking full database compromise. This flaw highlights the importance of secure coding practices, such as input validation and parameterized queries, to prevent injection attacks.
Platform: XWiki Full Calendar
Version: <=2.4.3
Vulnerability: SQL injection
Severity: Critical
date: Jan 9, 2026
Prediction: Patched in 2.4.5
What Undercode Say:
Analytics:
curl -I http://localhost:8080/xwiki/bin/view/Calendar.JSONService grep "fullcalendar" /path/to/xwiki/WEB-INF/lib/.jar find /xwiki -name ".xml" | xargs grep -l "JSONService"
how Exploit:
Craft malicious parameters in Calendar.JSONService requests to inject SQL commands like UNION SELECT or SLEEP(), enabling data extraction or DoS via resource exhaustion.
Protection from this CVE
Update to version 2.4.5; remove Calendar.JSONService page via admin tools; implement input validation and parameterized queries.
Impact:
Unauthorized database access; Denial-of-Service attacks; potential full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
