CVE-2025-32429: XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
Impact
It's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.
One can see the result of the injection with http://127.0.0.1:8080/xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm&sort=injected (this example does not work, but it shows that an HQL query was executed with the passed value which look nothing like an order by value, without any kind of sanitation).
Patches
This has been patched in 17.3.0-rc-1, 16.10.6.
Workarounds
There is no known workaround, other than upgrading XWiki.
References
https://jira.xwiki.org/browse/XWIKI-23093
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Attribution
The vulnerability was identifier by Aleksey Solovev from Positive Technologies.
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32429?
CVE-2025-32429 has a high severity rating due to SQL injection vulnerabilities that could lead to unauthorized access and data manipulation.
How do I fix CVE-2025-32429?
To fix CVE-2025-32429, upgrade to version 17.3.0-rc-1 or 16.10.6 of the affected software packages.
What software versions are affected by CVE-2025-32429?
CVE-2025-32429 affects versions between 9.4-rc-1 and 17.0.0-rc-1, and includes versions 16.10.6 and 17.3.0-rc-1.
What are the potential impacts of exploiting CVE-2025-32429?
Exploitation of CVE-2025-32429 can lead to unauthorized data access, data corruption, or deletion through SQL injection.
How can I identify if my system is vulnerable to CVE-2025-32429?
You can identify if your system is vulnerable to CVE-2025-32429 by checking if you are running affected versions of the software and testing for SQL injection in the specified parameter.