ExploitPublished 28 Jul 2025

XWiki 14 · SQL Injection via getdeleteddocuments.vm

Source Exploit-DB RSS Feed

Severity

Medium

Rated by Threat Radar

Data as of 29 Sep 2025, 00:52 UTC

What to do

AI-suggested

European organizations should immediately audit their XWiki 14 installations to identify if the getdeleteddocuments.vm component is in use and exposed. Since no official patches are currently referenced, organizations should consider the following mitigations: 1) Apply strict input validation and sanitization on all user inputs related to the vulnerable component, ideally by disabling or restricting access to getdeleteddocuments.vm if not required. 2) Employ Web Application Firewalls (WAFs) with custom rules to detect and block SQL Injection payloads targeting this endpoint. 3) Monitor logs for suspicious database queries or unusual access patterns to the vulnerable template. 4) Restrict network access to the XWiki server to trusted users and networks where possible. 5) Plan for an upgrade or patch deployment once official fixes become available from XWiki maintainers. 6) Conduct penetration testing focused on SQL Injection vectors to identify and remediate similar vulnerabilities. 7) Backup critical data regularly to enable recovery in case of data tampering.

Description

XWiki 14 - SQL Injection via getdeleteddocuments.vm

Impact

For European organizations using XWiki 14, this vulnerability poses a significant risk to the confidentiality and integrity of their data. Since XWiki is often used for internal documentation, knowledge bases, and collaboration, successful exploitation could expose sensitive corporate information, intellectual property, or personal data, potentially violating GDPR requirements. The SQL Injection could also allow attackers to manipulate or delete data, disrupting business operations and damaging trust. Given that XWiki is web-based, exploitation can be performed remotely without authentication, increasing the attack surface. Organizations in sectors such as finance, healthcare, government, and critical infrastructure that rely on XWiki for documentation or workflow management are particularly at risk. The medium severity rating suggests that while the vulnerability is serious, exploitation may require some conditions or may not lead to full system compromise without additional vulnerabilities.

Indicators of compromise

Exploit source code

Exploit code for XWiki 14 - SQL Injection via getdeleteddocuments.vmC/C++ · 24,245 characters

# Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm
# Google Dork: N/A
# Date: 28 July 2025
# Exploit Author: Byte Reaper
# LinkedIn: N/A
# Vendor Homepage: https://www.xwiki.org
# Software Link: https://www.xwiki.org
# Version: XWiki Platform ≤ 14.x
# Tested on: XWiki Platform ≤ 14.x
# CVE: CVE-2025-32429

## Vulnerability Description

A blind SQL Injection vulnerability exists in the XWiki Platform’s `getdeleteddocuments.vm` template, specifically via the `sort` parameter. The…

References

Community reviews

Loading reviews…