CVE-2016-8904

SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2016-11-14

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• Dotcms (Dotcms)

References

• http://seclists.org/fulldisclosure/2016/Nov/0
• http://www.securityfocus.com/bid/94311
• https://github.com/dotCMS/core/pull/8460/
• https://github.com/dotCMS/core/pull/8468/
• https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html