Critical · published July 24, 2025
CVSS calls it critical at 9.3. It sits in the 99.8th percentile for exploit probability.
🔥 A simple parameter tweak could let attackers run rogue SQL commands on your XWiki instance! Think of it like a restaurant where a chef accepts any order without checking the menu — anyone could sneak in a dish that doesn’t even exist, potentially ruining the whole meal! An attacker could exploit this vulnerability to manipulate your database, retrieve sensitive information, or even delete documents entirely. With the power to modify SQL queries directly, the consequences could be absolutely devastating for your data integrity and privacy.
Think of it like a restaurant where a chef accepts any order without checking the menu — anyone could sneak in a dish that doesn’t even exist, potentially ruining the whole meal! This vulnerability allows unauthorized SQL injection through the 'sort' parameter in the getdeleteddocuments.vm, executing arbitrary SQL commands without any proper validation.
An attacker could exploit this vulnerability to manipulate your database, retrieve sensitive information, or even delete documents entirely. With the power to modify SQL queries directly, the consequences could be absolutely devastating for your data integrity and privacy. Update your XWiki to version 16.10.6 or 17.3.0-rc-1 immediately to patch this flaw. Additionally, review your application's input sanitization practices and consider implementing parameterized queries to mitigate future risks. This is fixable! Get that update in place and you’ll be back to security hero status in no time! 🦸