XWiki Platform CVE-2025-52472

Exploitation targets the XWiki REST search API (wiki and space search, e.g. /xwiki/rest/wikis/{wiki}/search) via the orderField query parameter, which is concatenated into an HQL ORDER BY/SELECT without sanitization. Per the CVSS vector (PR:N) the endpoint is reachable unauthenticated, but in practice the attacker must be able to reach the search endpoint - most impactful where anonymous/guest users retain view and search rights. The key LIMITING factor is structural: the orderField value is injected twice into the generated query (field list and order clause), so a working payload must use single quotes to null out intervening fragments while keeping BOTH copies valid HQL - this materially raises exploitation complexity. Payloads are also database-dependent (the published PoC uses PostgreSQL-specific pg_sleep). Applies to XWiki 4.3-milestone-1 up to (but not including) 16.10.9 / 17.4.2; no workaround exists other than upgrading.

This is a genuine high-priority issue for internet-facing XWiki instances, but the raw 9.3 (CVSS 4.0) overstates ease of exploitation. The vendor vector claims AV:N/AC:L/PR:N/UI:N (unauthenticated, low complexity, full VC/VI/VA:H), yet the official description and GHSA advisory explicitly state the flaw is 'not that easy to exploit' because the orderField value is inserted TWICE in the generated HQL - once in the SELECT field list and once in the ORDER BY clause - so any payload must keep BOTH copies syntactically valid via careful quote balancing. This is a direct CVSS conflict: the vendor rates AC:L, but their own exploitation narrative is consistent with AC:H - verify complexity before treating as trivially weaponizable. EPSS is 2.37% (83rd percentile), elevated relative to the average CVE but still a low absolute probability, and the vulnerability is NOT in CISA KEV, indicating no confirmed active exploitation - consistent with a theoretically serious but operationally fiddly injection. A proof-of-concept time-based (PostgreSQL pg_sleep) payload and full request URL are published in the GHSA advisory, lowering the research barrier. Net: patch promptly on any XWiki reachable by untrusted users (especially where guests can search), but this is more 'serious bug with public PoC, exploitation constrained' than 'mass-exploited critical.'

An unauthenticated attacker sends a crafted GET request to the XWiki REST search endpoint (e.g. /xwiki/rest/wikis/{wiki}/search) with a malicious orderField parameter containing an HQL injection that uses single quotes to neutralize the surrounding query fragments. The GHSA advisory publishes a working time-based payload using pg_sleep to prove injection, enabling boolean/time-based extraction of database contents. Because the attacker-controlled value is reflected into the query twice, the payload must remain valid in both positions, making reliable data exfiltration non-trivial but demonstrated.