PT-2025-40901 · Xwiki · Xwiki Platform

Michael Hamann · Published 2025-05-26 · Updated 2025-12-01 · CVE-2025-52472

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 4.3-milestone-1 through 16.10.8 XWiki Platform versions 17.4.0 through 17.4.1 XWiki Platform versions 17.5.0

Description The XWiki Platform, a generic wiki platform, contains a flaw in the REST search URL. The orderField parameter is susceptible to HQL injection. The value provided for this parameter is included twice in the query, requiring careful manipulation to exploit. Specifically, enclosing the query segment between the two instances of the field in single quotes can bypass the constraints, but the query must remain valid with the parameter appearing twice. This issue affects versions starting from 4.3-milestone-1 and is addressed in versions 16.10.9, 17.4.2, and 17.5.0. The API endpoint involved is the REST search URL. The vulnerable parameter is orderField.

Recommendations Update to XWiki Platform version 16.10.9 or later. Update to XWiki Platform version 17.4.2 or later. Update to XWiki Platform version 17.5.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-12562

CVE-2025-52472

GHSA-GPRP-H92G-GC2H

Affected Products

Xwiki Platform

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52472.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-52472 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12562 · Security Note
• https://osv.dev/vulnerability/GHSA-gprp-h92g-gc2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52472 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gprp-h92g-gc2h · Note
• https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445 · Note
• https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1 · Note
• https://leakix.net/search?q=%2Bplugin%3AXWikiPlugin&scope=leak · Reddit Post
• https://twitter.com/0dayPublishing/status/1975216740574400717 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://jira.xwiki.org/browse/XWIKI-23247 · Note
• https://twitter.com/CveFindCom/status/1975217270071697661 · Twitter Post
• https://twitter.com/CVEnew/status/1975218457449763097 · Twitter Post