{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xwiki-platform--16.10.6-17.2.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-32429"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XWiki","XWiki Platform (\u003c 16.10.6, 17.2.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["XWiki"],"content_html":"\u003cp\u003eCVE-2025-32429 is a blind SQL injection vulnerability identified in the XWiki LiveData REST API. The vulnerability exists within the 'sort' parameter of the 'getdeleteddocuments.vm' endpoint. Unauthenticated attackers can leverage this flaw to perform time-based or UNION-based SQL injection, potentially leading to unauthorized data exfiltration from the underlying database. The vulnerability has been confirmed with a CVSS score of 9.8.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReconnaissance: Attacker identifies a target instance of XWiki.\u003c/li\u003e\n\u003cli\u003eWAF Detection: The exploit tool sends a test payload with a \u0026quot;sqlmap\u0026quot; User-Agent to identify if a WAF is present.\u003c/li\u003e\n\u003cli\u003eInjection: Attacker sends a crafted HTTP request to 'getdeleteddocuments.vm' containing SQL payloads in the 'sort' parameter.\u003c/li\u003e\n\u003cli\u003eExecution: The XWiki application processes the unsanitized input within the database query.\u003c/li\u003e\n\u003cli\u003eData Exfiltration: Attacker interprets application response times (time-based) or injected content (UNION-based) to reconstruct database records.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to query the database, potentially leading to full compromise of the instance's data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all XWiki Platform instances to version 16.10.6 or 17.2.2 or later to address the vulnerability in 'getdeleteddocuments.vm'.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to 'getdeleteddocuments.vm' containing SQL metacharacters (e.g., 'SLEEP', 'UNION', 'SELECT') in the query parameters.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or use an allowlist for the 'sort' parameter to restrict accepted inputs to authorized field names.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T13:35:50Z","date_published":"2026-11-03T15:42:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xwiki-info-disclosure/","summary":"CVE-2025-32429 is a critical blind SQL injection vulnerability in the XWiki LiveData REST API allowing unauthenticated attackers to extract database contents via the sort parameter in getdeleteddocuments.vm.","title":"XWiki Platform: Blind SQL injection in getdeleteddocuments.vm (CVE-2025-32429)","url":"https://feed.craftedsignal.io/briefs/2026-11-xwiki-info-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - XWiki Platform (\u003c 16.10.6, 17.2.2)","version":"https://jsonfeed.org/version/1.1"}