N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54385

CVE-2025-54385: XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

Impact

It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY.

The XWiki#searchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query (for example in the WHERE).

Patches

This has been patched in 16.10.6 and 17.3.0-rc-1.

Workarounds

There is no known workaround, other than upgrading XWiki.

References

https://jira.xwiki.org/browse/XWIKI-22728

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54385

CVE-2025-54385:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 1.0, < 16.10.6	16.10.6
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 17.0.0-rc1, < 17.3.0-rc-1	17.3.0-rc-1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several public methods within the com.xpn.xwiki.api.XWiki class that are exposed through the XWiki scripting API. These methods, including various overloads of searchDocuments, searchSpacesNames, searchAttachments, and countAttachments, accept a string parameter representing an HQL WHERE clause.

Prior to the patch, these methods passed the user-provided HQL string directly to the underlying Hibernate query engine without sufficient validation. Hibernate's HQL parser allows the use of native database functions. In the case of an Oracle database, an attacker could use functions like DBMS_XMLGEN.GETXML to execute arbitrary SQL queries, as the input was concatenated into a larger HQL query. This constitutes a classic SQL injection vulnerability.

The patch addresses this by introducing a new method, checkSearchQueryAllowed, which is now called by all the vulnerable search methods. This method performs a security check. If the current user does not have programming rights, it uses the HQLStatementValidator to parse and inspect the provided HQL fragment to ensure it does not contain any blacklisted (and thus potentially malicious) keywords or constructs. If the validation fails, an exception is thrown, preventing the malicious query from being executed.

The runtime indicators of exploitation would be calls to any of the vulnerable functions listed, with a crafted HQL payload as an argument. For example, a profiler would show a call to com.xpn.xwiki.api.XWiki.searchDocuments('...malicious HQL...').

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.