9.8
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
## 📜 **Description**
A **critical RCE vulnerability** exists in **XWiki** that allows **unauthenticated attackers** to execute arbitrary system commands via vulnerable API endpoints.
Exploitation can result in:
- **Full server takeover**
- **Data theft or destruction**
- **Pivoting into internal networks**
---
## 💥 **Impact**
- **Complete compromise** of the affected XWiki instance and underlying OS.
- **Loss of confidentiality, integrity, and availability**.
---
## 🛠 **Fix / Mitigation**
- **Upgrade** to the latest patched version (****).
- **Restrict** or disable vulnerable API endpoints.
- Apply **WAF rules** to block malicious payloads.
## Exploitation:
## SHODAN DORK : ``` http.title:"XWiki" ```
## Usage:
``` git clone https://github.com/Hex00-0x4/CVE-2025-24893-XWiki-RCE.git ```
```cd CVE-2025-24893-XWiki-RCE ```
```python3 CVE-2025-24893.py```
A **critical RCE vulnerability** exists in **XWiki** that allows **unauthenticated attackers** to execute arbitrary system commands via vulnerable API endpoints.
Exploitation can result in:
- **Full server takeover**
- **Data theft or destruction**
- **Pivoting into internal networks**
---
## 💥 **Impact**
- **Complete compromise** of the affected XWiki instance and underlying OS.
- **Loss of confidentiality, integrity, and availability**.
---
## 🛠 **Fix / Mitigation**
- **Upgrade** to the latest patched version (****).
- **Restrict** or disable vulnerable API endpoints.
- Apply **WAF rules** to block malicious payloads.
## Exploitation:
## SHODAN DORK : ``` http.title:"XWiki" ```
## Usage:
``` git clone https://github.com/Hex00-0x4/CVE-2025-24893-XWiki-RCE.git ```
```cd CVE-2025-24893-XWiki-RCE ```
```python3 CVE-2025-24893.py```
Basic Information
ID
B938A437-C237-5C4D-B15E-379C2F2B054F
Published
Aug 8, 2025 at 05:38
Modified
Aug 8, 2025 at 09:12