Listen to this Post
How the CVE Works
The vulnerability arises in XWiki Platform due to improper input sanitization in the `getdeleteddocuments.vm` template. The `sort` parameter is directly injected into an HQL (Hibernate Query Language) query as an `ORDER BY` clause without validation. Attackers can manipulate this parameter to inject malicious SQL, leading to unauthorized database access or manipulation. For example, a crafted request like `http://127.0.0.1:8080/xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm&sort=injected` demonstrates the injection point. The lack of sanitization allows arbitrary HQL execution, bypassing intended query restrictions.
DailyCVE Form
Platform: XWiki Platform
Version: 9.4-rc-1 to 16.10.5, 17.0.0-rc-1 to 17.3.0-rc-1
Vulnerability: SQL Injection
Severity: Critical
Date: Jul 24, 2025
Prediction: Patch expected by Jul 31, 2025
What Undercode Say
Analytics:
SELECT FROM xwikidoc WHERE doc_name LIKE '%admin%' ORDER BY {injected};
GET /xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm&sort=1;DROP TABLE xwikidoc--
How Exploit:
- Craft malicious `sort` parameter.
- Bypass query restrictions.
- Exfiltrate database contents.
Protection from this CVE:
- Upgrade to 16.10.6/17.3.0-rc-1.
- Sanitize `sort` input.
- Disable vulnerable endpoints.
Impact:
- Unauthorized data access.
- Database manipulation.
- Potential system compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
