CVE-2017-5344
An issue was discovered in dotCMS through 3.6.1.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- dotCMS 3.6.1 - Blind Boolean SQL Injection2017-02-16 · webapps · php · Verified
Impact
An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Overcoming these controls permits a number of blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dotcms | Dotcms | through 3.6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://dotcms.com/security/SI-39
- http://seclists.org/fulldisclosure/2017/Feb/34
- http://www.securityfocus.com/bid/96259
- https://github.com/xdrr/webapp-exploits/blob/master/vendors/dotcms/2017.01.blind-sqli/dotcms-dump.sh
- https://www.exploit-db.com/exploits/41377/
- http://dotcms.com/security/SI-39
- http://seclists.org/fulldisclosure/2017/Feb/34
- http://www.securityfocus.com/bid/96259
- https://github.com/xdrr/webapp-exploits/blob/master/vendors/dotcms/2017.01.blind-sqli/dotcms-dump.sh
- https://www.exploit-db.com/exploits/41377/