CVE-2016-8902 SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
CriticalCVSS 9.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dotCMS | <= 3.3 | No fix listed |
References
- seclists.org third-party-advisory
- 94311 technical-description vdb-entry
- github.com patch vendor-advisory
- github.com patch vendor-advisory
- security.elarlang.eu exploit third-party-advisory