CVE-2016-8902
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
- Score
- CVSS 3.0 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2016-11-14
- Last modified
- 2024-08-06
- Weaknesses
- CWE-89
Affected products
References
- http://seclists.org/fulldisclosure/2016/Nov/0
- http://www.securityfocus.com/bid/94311
- https://github.com/dotCMS/core/pull/8460/
- https://github.com/dotCMS/core/pull/8468/
- https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
