CVE-2025-32429: XWiki Platform SQL Injection Vulnerability

CVE-2025-32429 Overview

CVE-2025-32429 is a critical SQL Injection vulnerability affecting XWiki Platform, a popular open-source wiki platform that provides runtime services for applications built on top of it. The vulnerability exists in the getdeleteddocuments.vm template, where the sort parameter is directly injected into SQL queries as an ORDER BY value without proper sanitization or validation. This allows unauthenticated attackers to execute arbitrary SQL commands against the underlying database.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to read, modify, or delete sensitive data from the XWiki database, potentially leading to complete database compromise and unauthorized access to wiki content.

Affected Products

• XWiki Platform versions 9.4-rc-1 through 16.10.5
• XWiki Platform versions 17.0.0-rc-1 through 17.2.2

Discovery Timeline

• 2025-07-24 - CVE-2025-32429 published to NVD
• 2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-32429

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the XWiki Platform's deleted documents functionality. The vulnerability stems from improper handling of user-supplied input in the getdeleteddocuments.vm template file. When users interact with the deleted documents feature, the sort parameter is passed directly to the SQL query's ORDER BY clause without any input validation, sanitization, or parameterized query implementation.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Successful exploitation allows attackers to manipulate database queries, potentially extracting sensitive information, modifying data, or escalating privileges within the XWiki application. Given that XWiki installations often contain sensitive organizational knowledge and user data, the impact of this vulnerability can be severe.

Root Cause

The root cause of this vulnerability is the direct concatenation of user-controlled input into SQL queries. The sort parameter value is inserted directly into the ORDER BY clause of the SQL statement without proper input validation, prepared statements, or parameterized queries. This classic SQL injection pattern allows attackers to break out of the intended query structure and inject malicious SQL code.

Attack Vector

The vulnerability is exploitable via network access through HTTP requests to the XWiki application. An attacker can craft malicious requests containing SQL injection payloads in the sort parameter when accessing the deleted documents functionality. Since no authentication is required to trigger the vulnerability, any user with network access to the XWiki instance can potentially exploit this flaw.

The attack exploits the ORDER BY injection point, which can be leveraged for various SQL injection techniques including time-based blind injection, error-based injection, or UNION-based attacks depending on the database backend configuration. Attackers can extract database contents, enumerate database structure, or potentially execute administrative database operations.

Detection Methods for CVE-2025-32429

Indicators of Compromise

• Unusual or malformed requests to getdeleteddocuments.vm containing SQL syntax in the sort parameter
• Database error messages in application logs indicating SQL syntax errors
• Unexpected database queries or query patterns in database audit logs
• Signs of data exfiltration or unauthorized database access

Detection Strategies

• Monitor web application logs for requests to getdeleteddocuments.vm with suspicious sort parameter values containing SQL keywords such as UNION, SELECT, INSERT, DELETE, DROP, or comment characters
• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP parameters
• Enable database query logging and monitor for anomalous ORDER BY clauses or query patterns
• Deploy intrusion detection systems with signatures for SQL injection attacks targeting wiki platforms

Monitoring Recommendations

• Configure alerting for failed SQL queries or database errors originating from XWiki application
• Monitor for unusual database access patterns, particularly bulk data reads or schema enumeration queries
• Implement anomaly detection for HTTP request patterns to XWiki endpoints
• Review access logs regularly for reconnaissance activity targeting deleted documents functionality

How to Mitigate CVE-2025-32429

Immediate Actions Required

• Upgrade XWiki Platform to version 16.10.6 or 17.3.0-rc-1 immediately
• If immediate upgrade is not possible, restrict network access to the XWiki instance using firewall rules
• Deploy WAF rules to filter SQL injection attempts targeting the sort parameter
• Monitor for exploitation attempts while planning the upgrade

Patch Information

XWiki has released security patches addressing this vulnerability. The fixes are available in:

• Version 16.10.6 - For users on the 16.x branch
• Version 17.3.0-rc-1 - For users on the 17.x branch

Detailed information about the patches can be found in the GitHub Security Advisory and the XWiki JIRA Issue XWIKI-23093. The specific code changes are available in the GitHub commits: commit dfd0744 and commit f502b5d.

Workarounds

• Restrict access to the deleted documents functionality through XWiki's access control mechanisms
• Implement network-level access controls to limit who can reach the XWiki application
• Deploy a Web Application Firewall configured with SQL injection detection rules
• Consider temporarily disabling or removing the getdeleteddocuments.vm template if the functionality is not critical

# Example: Block access to vulnerable endpoint using nginx
location ~ /xwiki/bin/view/.*getdeleteddocuments {
    deny all;
    return 403;
}