# CVE-2025-52472: XWiki-Platform - SQLi

> Live exploitation tracking for CVE-2025-52472 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-52472

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** XWiki-Platform
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** web_application, enterprise_software

## Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.

## CrowdSec analysis

[CVE-2025-52472](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-52472) is a critical vulnerability in XWiki Platform versions 4.3-milestone-1 through 17.4.1 and 16.10.8, where the REST search URL is susceptible to HQL injection via the orderField parameter. This flaw could allow remote attackers to manipulate database queries, potentially leading to unauthorized data access or modification. Although exploitation is somewhat complex due to the parameter's use in multiple query locations, successful attacks could compromise the integrity and confidentiality of the XWiki instance.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-52472 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-52472 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the XWiki REST API endpoint `/xwiki/rest/wikis/xwiki/search` by injecting malicious HQL statements into the `orderField` parameter, enabling unauthorized query execution and potential data extraction or remote code execution.

## Timeline

- 2025-10-06: CVE Published. CVE-2025-52472 is published to NVD.
- 2025-11-26: Rule Released. CrowdSec releases a rule to detect CVE-2025-52472 exploitation attempts against the CrowdSec Network.
- 2025-11-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-52472 for the first time.

## References

- https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445
- https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1
- https://jira.xwiki.org/browse/XWIKI-23247
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gprp-h92g-gc2h
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52472.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-52472) follows observed exploitation activity for CVE-2025-52472. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.