XWiki Platform (< 16.10.6, 17.2.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/xwiki-platform--16.10.6-17.2.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 15:42:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXWiki Platform: Blind SQL injection in getdeleteddocuments.vm (CVE-2025-32429)https://feed.craftedsignal.io/briefs/2026-11-xwiki-info-disclosure/Tue, 03 Nov 2026 15:42:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xwiki-info-disclosure/CVE-2025-32429 is a critical blind SQL injection vulnerability in the XWiki LiveData REST API allowing unauthenticated attackers to extract database contents via the sort parameter in getdeleteddocuments.vm.CVE-2025-32429 is a blind SQL injection vulnerability identified in the XWiki LiveData REST API. The vulnerability exists within the 'sort' parameter of the 'getdeleteddocuments.vm' endpoint. Unauthenticated attackers can leverage this flaw to perform time-based or UNION-based SQL injection, potentially leading to unauthorized data exfiltration from the underlying database. The vulnerability has been confirmed with a CVSS score of 9.8.

Attack Chain

  1. Reconnaissance: Attacker identifies a target instance of XWiki.
  2. WAF Detection: The exploit tool sends a test payload with a "sqlmap" User-Agent to identify if a WAF is present.
  3. Injection: Attacker sends a crafted HTTP request to 'getdeleteddocuments.vm' containing SQL payloads in the 'sort' parameter.
  4. Execution: The XWiki application processes the unsanitized input within the database query.
  5. Data Exfiltration: Attacker interprets application response times (time-based) or injected content (UNION-based) to reconstruct database records.

Impact

Successful exploitation allows unauthenticated attackers to query the database, potentially leading to full compromise of the instance's data.

Recommendation

  • Upgrade all XWiki Platform instances to version 16.10.6 or 17.2.2 or later to address the vulnerability in 'getdeleteddocuments.vm'.
  • Monitor web server logs for requests to 'getdeleteddocuments.vm' containing SQL metacharacters (e.g., 'SLEEP', 'UNION', 'SELECT') in the query parameters.
  • Implement strict input validation or use an allowlist for the 'sort' parameter to restrict accepted inputs to authorized field names.
]]>criticaladvisory