Описание
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2016-8902
- https://github.com/dotCMS/core/pull/8460
- https://github.com/dotCMS/core/pull/8468
- https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
- http://seclists.org/fulldisclosure/2016/Nov/0
- http://www.securityfocus.com/bid/94311
Связанные уязвимости
CVSS3: 9.8
nvd
около 9 лет назад
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.