PT-2017-16445 · Dotcms · Dotcms

Ben Nott · Published 2017-02-17 · Updated 2017-09-01 · CVE-2017-5344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.6.2

Description An issue was discovered in the findChildrenByFilter() function, which is called by the web-accessible path /categoriesServlet. This function performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented as part of a remediation effort, these controls can be overcome in the case of the q and inode parameters to the /categoriesServlet path. This allows for blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.

Recommendations For dotCMS versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /categoriesServlet path to minimize the risk of exploitation. Avoid using the q and inode parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-5344

Affected Products

Dotcms

References · 8

• 🔥 https://github.com/xdrr/webapp-exploits/blob/master/vendors/dotcms/2017.01.blind-sqli/dotcms-dump.sh · Exploit
• 🔥 https://exploit-db.com/exploits/41377 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Feb/34 · Exploit
• http://dotcms.com/security/SI-39 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5344 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5344 · Vendor Advisory
• http://securityfocus.com/bid/96259 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5344 · Note