Listen to this Post
How the CVE Works
The vulnerability exists in the `XWikisearchDocuments` API, which fails to properly sanitize user-supplied input before constructing SQL queries. In Oracle databases, attackers can abuse functions like `DBMS_XMLGEN` or `DBMS_XMLQUERY` to execute arbitrary SQL commands. Hibernate Query Language (HQL) does not restrict the use of native database functions, allowing malicious queries to bypass intended restrictions. This enables unauthorized data access, manipulation, or database compromise.
DailyCVE Form
Platform: XWiki Platform
Version: 1.0 – 16.10.5, 17.0.0-rc1 – 17.3.0-rc1
Vulnerability: SQL Injection
Severity: Critical
Date: Jul 25, 2025
Prediction: Patch expected by Jul 30, 2025
What Undercode Say
Analytics:
SELECT FROM xwikidoc WHERE 1=1; DROP TABLE xwikidoc--
xwiki.searchDocuments("where 1=1; DBMS_XMLGEN.getXML('SELECT FROM users')");
How Exploit:
- Craft malicious HQL query via
searchDocuments. - Leverage Oracle-native functions (
DBMS_XMLGEN). - Exfiltrate or modify database content.
Protection from this CVE:
- Upgrade to XWiki 16.10.6/17.3.0-rc-1.
- Disable unnecessary Oracle functions.
- Enforce input sanitization.
Impact:
- Unauthorized SQL execution.
- Data theft/manipulation.
- Full database compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
