SQL injection in short form select requests through the script query API

XWIKI-22691 describes a way to go "out of" the HQL request to add any other native requests after the first select statement.

This is not possible with the secure query manager (mainly because it simply fails to parse a statement which contains such a hack). Unfortunately, like in the case of the query REST resource for XWIKI-22691, the secure query manager is not applied when using short form queries.

For example, the following allow anyone with just scrip right to get all the values from the xwikistrings table (where xobject String properties are stored):

{{velocity}}
$services.query.hql("where 1<>'1\'' union select CONCAT(XWS_NAME,""."",XWS_VALUE) from xwikistrings #'").execute()
{{/velocity}}