XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.3epss 85%
from disclosure to weapon1 days
Published on NVDJul 24
1st PoC+1d
VulnCheck+102d
exploitation probability
85%top 1% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
In short
XWiki's deleted documents page allows attackers to inject malicious SQL commands through the sort parameter, potentially exposing or manipulating sensitive database information without authentication.
Technical detail
SQL injection vulnerability in getdeleteddocuments.vm template where the sort parameter is directly embedded into ORDER BY clauses without sanitization. Affects unauthenticated users; exploitation requires network access to the XWiki instance. Impact includes unauthorized data access, modification, or deletion from the underlying database.
Summary generated and translated by AI from the official description.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
xwiki · xwiki-platformpublic PoCs found — 7
exploitdbwww.exploit-db.com/exploits/52384unverifiedgithubgithub.com/byteReaper77/CVE-2025-32429★ 10githubgithub.com/amir-othman/CVE-2025-32429★ 0githubgithub.com/imbas007/CVE-2025-32429-Checker★ 0vulncheckvulncheck.com/xdb/793c91104a2dunverifiedvulncheckvulncheck.com/xdb/3dfc01bb04d5unverifiedvulncheckvulncheck.com/xdb/fe51ae085d35unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cqhttps://jira.xwiki.org/browse/XWIKI-23093