Remote code execution via DatabaseSearch

Steps to reproduce:

1. Open the database search at Main.DatabaseSearch
2. Search for 

   }}}{{async async=false}}{{groovy}}println("Hello from" + " search text:" + (23 + 19)){{/groovy}}{{/async}} 

1. Click on the RSS feed link below the search
2. View the source of the page

Expected result:

An RSS feed where title and description contain the entered text is displayed.

Actual result:

The RSS feed is broken, the title is "RSS feed for search on Hello from search text:42". This clearly shows that the Groovy code has been executed.

This demonstrates remote code execution from view right on the database search (by default set for guests).

The exploitable code exists at least since XASEARCH-1 which has been released in XWiki 2.4 M1.