CSRF with QueryOnXWiki allows arbitrary database queries

Steps to reproduce:

1. Add a comment with an image [[image:path:/xwiki/bin/view/Admin/QueryOnXWiki?query=DELETE%20FROM%20xwikidoc]].
2. Wait for an admin to view the comment.

Expected result:

The wiki continues to work.

Actual result:

All documents are deleted from the database, the wiki is empty after a restart or after emptying caches. Note that the same mechanism could also be used to grant admin rights to the user with an appropriate database query.