-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 1.6-milestone-1, < 15.10.16 | 15.10.16 |
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 16.0.0-rc-1, < 16.4.6 | 16.4.6 |
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 16.5.0-rc-1, < 16.10.1 | 16.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability allows SQL injection through the script query API, specifically when using short-form HQL select queries. The provided exploit example uses $services.query.hql("...").execute(). The commit 28af3e62d0c49d999a4a9998155eed852b88765f directly addresses this (XWIKI-22718) by modifying com.xpn.xwiki.store.hibernate.query.HqlQueryExecutor.java. The key changes are in the isSafeSelect method, which previously did not adequately validate short-form HQL queries. The patch ensures these queries are converted to a complete form via toCompleteShortForm before being validated by HqlQueryUtils.isSafe(). The execute method of HqlQueryExecutor is the entry point for query execution and calls checkAllowed, which in turn uses isSafeSelect. Therefore, execute, checkAllowed, and isSafeSelect in HqlQueryExecutor are central to the vulnerability and its fix. The QueryScriptService#hql method (or its equivalent) is the initial script API entry point for the malicious HQL, but the core flaw and fix are within HqlQueryExecutor.java, making those functions higher confidence for direct vulnerability involvement based on the patch. The QueryScriptService#hql is an entry point but its direct code wasn't shown as modified in the specific patch for XWIKI-22718, hence it's included with medium confidence as part of the exploitation chain but not the direct location of the patched flaw itself based on the commit diff for XWIKI-22718