CVE-2025-65091: XWiki Full Calendar Macro SQLi Vulnerability

CVE-2025-65091 Overview

CVE-2025-65091 is a SQL Injection vulnerability affecting the XWiki Full Calendar Macro component. The vulnerability exists in the Calendar.JSONService page, which can be exploited by users with view permissions—including unauthenticated guest users—to perform SQL injection attacks. Successful exploitation allows attackers to access sensitive database information or launch Denial of Service (DoS) attacks against the affected XWiki installation.

Critical Impact

Unauthenticated attackers can exploit this SQL injection to extract sensitive database contents or disrupt wiki availability through DoS attacks.

Affected Products

• XWiki Full Calendar Macro versions prior to 2.4.5
• XWiki installations with Calendar.JSONService page accessible to guest users
• XWiki deployments using the macro-fullcalendar extension

Discovery Timeline

• 2026-01-10 - CVE CVE-2025-65091 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-65091

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The flaw resides in the Calendar.JSONService endpoint of the XWiki Full Calendar Macro extension. When processing calendar data requests, the service fails to properly sanitize user-supplied input before incorporating it into SQL queries.

The attack surface is particularly concerning because the vulnerable endpoint is accessible to unauthenticated users by default. This means attackers can exploit the vulnerability without requiring any credentials, significantly lowering the barrier to exploitation. The impact spans across confidentiality, integrity, and availability—attackers can extract sensitive data from the database, potentially modify stored information, and cause service disruption through resource-intensive queries.

Root Cause

The root cause of this vulnerability stems from insufficient input validation and improper handling of user-controlled data within the Calendar.JSONService page. The service constructs SQL queries by directly concatenating user input without proper parameterization or escaping, allowing attackers to inject arbitrary SQL commands. This represents a fundamental secure coding failure where dynamic query construction bypasses essential input sanitization mechanisms.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the Calendar.JSONService endpoint, injecting SQL payloads through vulnerable parameters. The attack can be executed remotely from any network location with access to the XWiki installation.

Exploitation typically involves sending specially crafted requests that append malicious SQL statements to legitimate queries. Attackers may use techniques such as UNION-based injection to extract data from other database tables, blind SQL injection to infer database contents through boolean conditions, or time-based attacks to enumerate database schema. For DoS scenarios, attackers can craft computationally expensive queries that exhaust database resources.

The vulnerability mechanism involves manipulating calendar-related parameters that are processed by the JSONService. When these parameters contain SQL metacharacters and injection payloads, the backend query executor processes them as part of the SQL command rather than as data values. Technical details and the specific fix can be found in the GitHub Security Advisory.

Detection Methods for CVE-2025-65091

Indicators of Compromise

• Unusual or malformed requests to the Calendar.JSONService endpoint containing SQL keywords (SELECT, UNION, INSERT, DROP, etc.)
• Abnormally high database query times or resource consumption originating from calendar service queries
• Error messages in application logs indicating SQL syntax errors or database exceptions
• Unexpected database access patterns or queries accessing tables unrelated to calendar functionality

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to XWiki calendar endpoints
• Monitor application logs for SQL error messages or exception traces that may indicate injection attempts
• Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing common SQL injection payloads

Monitoring Recommendations

• Enable verbose logging for the XWiki application server to capture detailed request information for forensic analysis
• Set up alerting for failed authentication attempts followed by direct access to Calendar.JSONService
• Monitor database server performance metrics for sudden spikes in query execution time or connection counts
• Review access logs regularly for patterns of automated scanning or exploitation attempts targeting calendar endpoints

How to Mitigate CVE-2025-65091

Immediate Actions Required

• Upgrade the XWiki Full Calendar Macro extension to version 2.4.5 or later immediately
• If immediate upgrade is not possible, restrict access to the Calendar.JSONService page to authenticated users only
• Review XWiki access control lists to ensure guest users do not have unnecessary access to sensitive service pages
• Conduct a security assessment of the XWiki installation to identify any signs of prior exploitation

Patch Information

The vulnerability has been addressed in XWiki Full Calendar Macro version 2.4.5. The fix implements proper input sanitization and parameterized queries for the Calendar.JSONService endpoint. Organizations should apply this patch as the primary remediation measure.

The security patch is available through the official commit. Additional details about the vulnerability and remediation steps are documented in the GitHub Security Advisory GHSA-2g22-wg49-fgv5.

Workarounds

• Configure XWiki access rights to deny guest/anonymous access to the Calendar.JSONService page until patching is complete
• Deploy a web application firewall with SQL injection detection rules as a temporary protective layer
• Disable or uninstall the Full Calendar Macro extension if it is not essential for operations
• Implement network-level access controls to limit which hosts can reach the XWiki installation

# Example: Restrict access to Calendar.JSONService via XWiki configuration
# Add to xwiki.cfg or equivalent configuration file
# Deny guest access to vulnerable service page
xwiki.rights.Calendar.JSONService.view=admin,XWikiAllGroup