HQL Injection Vulnerability in LiveTableResults/TourLiveTableResults/UserDirectoryLivetableResults

Description:

The user input is being interpreted as part of the query logic instead of as a parameter value, and it never checked! 

The LiveTableResults (same for TourLiveTableResults & TourLiveTableResults ) endpoint is vulnerable to HQL Injection. The parameters sort, classname, and collist are concatenated directly into the HQL query without validation.
This allows attackers to manipulate the database query logic to bypass filters.

Preconditions:

• The user (unregistered user or logged-in user) must have View permission on the XWiki.LiveTableResults {{ (same for TourLiveTableResults & TourLiveTableResults)}} page

Steps to Reproduce:

1. As a user with View rights, open the following URL in a browser:

https://<TARGET_HOST>/wiki/<WIKI_NAME>/get/XWiki/LiveTableResults?classname=Help.Applications.Contributors.Code.ContributorsClass&collist=longText1,doc.title,staticList1,date1&limit=5&outputSyntax=plain&reqNo=11&dir=asc&sort=doc.title%252529 notice "sort=doc.title%252529"

1. Observe the  response .
2. Search the page content for the string order by lower(doc.title')
3. Or search for  doc.title2529noticesortdoctitle2529 : 

Caused by: java.lang.IllegalArgumentException: org.hibernate.QueryException: could not resolve property: title2529noticesortdoctitle2529 of: com.xpn.xwiki.doc.XWikiDocument [select doc.fullName from com.xpn.xwiki.doc.XWikiDocument doc , com.xpn.xwiki.objects.BaseObject as obj   where obj.name=doc.fullName and obj.className = :className and doc.fullName not in (:classTemplate1, :classTemplate2)    order by lower(doc.title2529noticesortdoctitle2529) asc, doc.title2529noticesortdoctitle2529 asc] 

1. The input successfully bypassed the security checks and hit the database engine.

Same for :
UserDirectoryLivetableResults
TourLiveTableResults

Actual Result:

XWiki took my input and pasted it directly into the HQL query structure!{}

The system returns a Java stack trace showing that the single quote was injected directly into the HQL ORDER BY clause.

Expected Result:

The system should either sanitize the input, reject the invalid character, or fall back to a default sort order without generating a database syntax error