Описание
SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter.
SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2016-8905
- https://github.com/dotCMS/core/pull/8460
- https://github.com/dotCMS/core/pull/8468
- https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
- http://seclists.org/fulldisclosure/2016/Nov/0
- http://www.securityfocus.com/bid/94311
Связанные уязвимости
CVSS3: 8.8
nvd
около 9 лет назад
SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter.