SQL injection in XWiki Platform getdeleteddocuments.vm sort parameter

This repository is a small standalone C-based proof-of-concept exploit consisting of two files: a README and a single source file, exploit.c. The README claims CVE-2025-32429 affects PHP PDO prepared statements, but the actual exploit code targets XWiki and specifically references SQL injection through the sort operator in getdeleteddocuments.vm on the endpoint /xwiki/rest/liveData/sources/liveTable/entries. That mismatch is notable and suggests the README description is partially inaccurate or copied from another context, while the code itself is focused on XWiki exploitation. The exploit is not part of a common framework. It uses libcurl for HTTP requests and argparse for command-line parsing. The main entry point accepts a base URL (-u), optional cookies (-c), and verbose mode (-v). It constructs requests to the XWiki REST endpoint with sourceParams.template=getdeleteddocuments.vm and injects payloads into sourceParams.sort. The payload set includes boolean-based SQLi strings, comment-based bypasses, and time-based payloads using SLEEP(5) and WAITFOR DELAY, indicating support for testing multiple backend SQL dialect behaviors. The code includes response buffering via a write callback and appears intended to analyze returned content for SQL-related indicators using a hardcoded keyword list including select, union, insert, update, delete, drop, sleep, benchmark, mysql, pg_, xp_, and error/warning terms. This indicates the exploit's purpose is to validate SQL injection by observing response content and/or timing behavior rather than to deliver a post-exploitation shell or arbitrary code execution payload. Operationally, the exploit is capable of sending crafted HTTP requests to a remote web target, optionally with cookies, making it suitable for authenticated or semi-authenticated testing scenarios if the vulnerable endpoint requires session state. There is no evidence of destructive local behavior or fake logic. Aside from the exploit logic, the code contains some unusual inline assembly for exiting the process and invoking /bin/ping google.com when curl initialization fails; this appears ancillary and not part of the exploit path itself. Overall, this is a real web/network SQL injection PoC with hardcoded payloads aimed at detecting and demonstrating vulnerability in an XWiki endpoint, despite inconsistent repository labeling around PHP PDO.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-32429, a SQL injection vulnerability in the XWiki platform when using PHP PDO prepared statements with emulation enabled. The repository consists of a README.md (usage instructions and background) and a single C source file (exploit.c) implementing the exploit logic. The exploit takes a target base URL as input and injects a series of SQLi payloads into the 'sort' parameter of the XWiki REST endpoint '/xwiki/rest/liveData/sources/liveTable/entries?sourceParams.template=getdeleteddocuments.vm'. It uses libcurl to send requests and checks for SQL injection by observing responses, including time-based payloads (e.g., sleep(5)). The code is a standalone PoC, not part of a framework, and is intended for research and demonstration purposes. No hardcoded credentials or backdoors are present; the exploit is focused on confirming the presence of the SQL injection vulnerability.

This repository provides a C-based proof-of-concept exploit for CVE-2025-32429, a blind SQL injection vulnerability in the XWiki Platform's LiveData REST API (specifically, the getdeleteddocuments.vm endpoint's 'sort' parameter). The repository contains three files: a LICENSE, a README.md with detailed usage and vulnerability information, and the main exploit code (exploit.c). The exploit is designed to be compiled on Linux and uses libcurl and argparse. It works by sending a series of SQL injection payloads to the vulnerable endpoint, measuring response times (to detect time-based injections), and searching for SQL-related keywords in the response. The tool can optionally use cookies for authenticated testing and provides verbose output for debugging. Its primary purpose is to detect the presence of the SQL injection vulnerability, not to extract data or provide a shell. The main fingerprintable endpoint is the XWiki REST API path with the vulnerable 'sort' parameter. The exploit is a proof-of-concept and does not include weaponized payloads.