Read the docs
TI-2023-26156 Aliases CVE-2023-48293GHSA-4f4c-rhjv-4wgv

XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries

Priority HIGH 73CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allows modifying and deleting all data of the wiki. This could be both used to damage the wiki and to create an account with elevated privileges for the attacker, thus impacting the confidentiality, integrity and availability of the whole XWiki instance. A possible attack vector are comments on the wiki, by embedding an image with wiki syntax like `[[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]]`, all documents would be deleted from the database when an admin user views this comment. This has been patched in Admin Tools Application 4.5.1 by adding form token checks. Some workarounds are available. The patch can also be applied manually to the affected pages. Alternatively, if the query tool is not needed, by deleting the document `Admin.SQLToolsGroovy`, all database query tools can be deactivated.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed application-admintools (xwiki-contrib): 4.5.1org.xwiki.contrib:xwiki-application-admintools (Maven): 4.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikiapplication-admintoolsbefore 4.5.14.5.1Patch availableCNA
—org.xwiki.contrib:xwiki-application-admintools (Maven)before 4.5.14.5.1Patch availableGHSA-4f4c-rhjv-4wgv
  • application-admintools VendorXWiki Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • org.xwiki.contrib:xwiki-application-admintools (Maven) Vendor— Affected before 4.5.1 Fixed in 4.5.1 Patch available GHSA-4f4c-rhjv-4wgv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*before 4.5.1VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions before 4.5.1 Vulnerable ·XWiki

Remediation

  • Fix · CNA application-admintools (xwiki-contrib) Fixed in 4.5.1
  • Fix · GHSA-4f4c-rhjv-4wgv org.xwiki.contrib:xwiki-application-admintools (Maven) Fixed in 4.5.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48293
  2. 2026-10-03 Alias added: GHSA-4f4c-rhjv-4wgv

References

Patch 2

Advisory 2

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences