-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe analysis of the provided patch commit reveals a classic SQL injection vulnerability within a Velocity template file, Calendar.JSONService.xml. The vulnerability is not in a compiled Java function but in the scripting logic of this template, which is executed by the XWiki platform. The original code allowed for direct concatenation of user input from request parameters into an HQL query string. Specifically, the sql request parameter could be used to inject arbitrary HQL, which was then executed. The patch addresses this by removing the unsafe, dynamic query construction and replacing it with a parameterized query approach. The vulnerable code unit is the script logic within the Calendar.JSONService.xml file itself, which acts as the service endpoint. Therefore, a runtime profiler would show calls originating from the rendering of this page, leading to the execution of the vulnerable query via XWiki's query service.
Calendar.JSONServicemacro-fullcalendar-ui/src/main/resources/Calendar/JSONService.xml
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.contrib:macro-fullcalendar-pom | maven | <= 2.4.3 | 2.4.5 |