CVE-2016-8902

Critical

Published: 14/11/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.

Risk Assessment

An attacker can exploit this vulnerability to manipulate data in the database, potentially leading to loss of confidentiality, integrity, or availability of data.

Recommendation

It is recommended to upgrade dotCMS to version 3.3.1 or later to mitigate this vulnerability and implement additional security measures such as input filtering and validation.

Original NVD description (English source)

SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.