CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 7.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: an issue was discovered in dotcms through 3.6.1. the findchildrenbyfilter() function which is called by the web accessible path /categoriesservlet performs string interpolation and direct sql query execution. sql quote escaping and a keyword blacklist were implemented in a new class, sqlutil (main/java/com/dotmarketing/common/util/sqlutil.java), as part of the remediation of cve-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesservlet path. overcoming these controls permits a number of blind boolean sql injection vectors in either parameter. the /categoriesservlet web path can be accessed remotely and without authentication in a default dotcms deployment.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-02-17
Last Modified Date: 2017-09-01