CVE-2025-52472 PoC — XWiki Platform SQL注入漏洞

Source

Associated Vulnerability

Description

XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.

File Snapshot

 id: CVE-2025-52472

info:
  name: XWiki - HQL Injection
  author: ritikchaddha
  severity: high
  de

...

Remarks