PT-2025-30912 · Xwiki · Xwiki

Thomas Mortagne · Published 2025-07-25 · Updated 2025-07-26 · CVE-2025-54385

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xWiki versions prior to 16.10.6 xWiki versions prior to 17.3.0-rc-1

Description The application allows execution of arbitrary SQL queries in Oracle databases using functions like DBMS XMLGEN or DBMS XMLQUERY. The XWiki#searchDocuments API does not sanitize queries, and Hibernate allows the use of native functions within HQL queries.

Recommendations Upgrade to xWiki version 16.10.6 or later. Upgrade to xWiki version 17.3.0-rc-1 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-20

CWE-89

Related Identifiers

BDU:2025-13439

CVE-2025-54385

GHSA-P9QM-P942-Q3W5

Affected Products

Xwiki

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54385.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9qm-p942-q3w5 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/7c4087d44ac550610b2fa413dd4f5375409265a5 · Patch
• https://github.com/xwiki/xwiki-platform/commit/7313dc9b533c70f14b7672379c8b3b63d1fd8f51 · Patch
• https://osv.dev/vulnerability/CVE-2025-54385 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22728 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13439 · Security Note
• https://osv.dev/vulnerability/GHSA-p9qm-p942-q3w5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54385 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CveFindCom/status/1948959341031088168 · Twitter Post
• https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html · Note
• https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html#GUID-C3A10A26-7D74-4A64-A09C-3F7FD5D54FF0 · Note
• https://twitter.com/CVEnew/status/1948976650206466525 · Twitter Post
• https://xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.6 · Note