CVE-2025-32968 Overview
CVE-2025-32968 is a blind SQL injection vulnerability in the XWiki platform, a generic open-source wiki system. The flaw allows a user with SCRIPT right to escape the Hibernate Query Language (HQL) execution context through a REST API and execute arbitrary SQL statements against the database backend. The vulnerability affects XWiki versions from 1.6-milestone-1 up to but not including 15.10.16, 16.4.6, and 16.10.1. Attackers can extract confidential data such as password hashes and, depending on the database engine, execute UPDATE, INSERT, or DELETE queries. The issue is tracked under CWE-89: SQL Injection.
Critical Impact
Authenticated users holding SCRIPT right can perform blind SQL injection against the XWiki database backend, enabling theft of credentials and modification of stored data.
Affected Products
- XWiki Platform versions 1.6-milestone-1 through 15.10.15
- XWiki Platform 16.x versions prior to 16.4.6
- XWiki Platform 16.10.0 (fixed in 16.10.1)
Discovery Timeline
- 2025-04-23 - CVE-2025-32968 published to NVD
- 2025-04-30 - Last updated in NVD database
Technical Details for CVE-2025-32968
Vulnerability Analysis
XWiki exposes a REST API that accepts HQL query fragments for evaluation against the underlying Hibernate-managed database. The endpoint did not enforce the same strict query validation applied elsewhere in the script API for complete SELECT queries. A user with SCRIPT right could supply crafted HQL fragments that escape the intended HQL execution context and reach the SQL layer.
Because Hibernate translates HQL to native SQL, the injection ultimately executes as arbitrary SQL on the backend. The blind nature of the issue means attackers infer data through boolean-based or time-based response variation rather than direct output. Depending on the database engine, exploitation extends beyond confidential reads to data modification through UPDATE, INSERT, or DELETE statements.
Root Cause
The REST API path that processes HQL fragments lacked the validation layer the script API enforces for complete SELECT queries. This inconsistency allowed query constructs that should require programming right to execute under the weaker SCRIPT right requirement, breaking the privilege boundary between scripting and database administration.
Attack Vector
Exploitation requires an authenticated account with SCRIPT right on the target XWiki instance. The attacker sends a malicious HQL fragment through the affected REST endpoint over the network. No user interaction is required beyond the attacker's own session. The vulnerability is exploitable remotely on any XWiki deployment that exposes its REST API to network-accessible clients.
No public proof-of-concept exploit is currently published. Technical details are available in the GitHub Security Advisory GHSA-g9jj-75mx-wjcx and the XWiki Jira issue XWIKI-22718.
Detection Methods for CVE-2025-32968
Indicators of Compromise
- Unexpected HQL query fragments containing SQL keywords such as UNION, SLEEP, BENCHMARK, or stacked statements in XWiki REST API request logs.
- Anomalous response-time patterns on REST endpoints that accept HQL parameters, indicative of time-based blind injection.
- Database audit log entries showing UPDATE, INSERT, or DELETE statements originating from the XWiki application user against authentication tables.
Detection Strategies
- Inspect web access logs for SCRIPT-rights accounts issuing repeated REST API calls to query endpoints with unusual payload lengths or special characters.
- Enable Hibernate SQL logging temporarily and review translated SQL for syntactically valid but semantically suspicious constructs.
- Correlate XWiki authentication events with subsequent database query anomalies to identify abuse of legitimate SCRIPT-right accounts.
Monitoring Recommendations
- Forward XWiki application logs and database audit logs to a centralized SIEM for correlation and retention.
- Alert on any modification of the xwikiusers table or password hash columns outside of expected administrative workflows.
- Track the population of accounts holding SCRIPT right and review changes to that set.
How to Mitigate CVE-2025-32968
Immediate Actions Required
- Upgrade XWiki to version 15.10.16, 16.4.6, or 16.10.1 or later as soon as possible.
- Audit all accounts holding SCRIPT right and revoke the privilege from users who do not require it.
- Rotate database credentials and reset stored password hashes if exploitation is suspected on affected instances.
Patch Information
The XWiki project released fixes in versions 16.10.1, 16.4.6, and 15.10.16. The patch applies the same strict query validation used for complete SELECT statements in the script API to the affected REST endpoint. Some valid but complex queries may now require the author to hold programming right rather than SCRIPT right. Patch details are documented in the GitHub Security Advisory GHSA-g9jj-75mx-wjcx.
Workarounds
- No vendor-supplied workaround exists other than upgrading to a fixed version.
- As a compensating control, restrict network exposure of the XWiki REST API to trusted clients only.
- Minimize the number of accounts granted SCRIPT right until the upgrade is applied.
# Verify installed XWiki version after upgrade
curl -s https://xwiki.example.com/xwiki/rest/ | grep -i version
# Expected: version >= 15.10.16, 16.4.6, or 16.10.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
