Unscored CVE-2016-3688 EUVD-2016-4712GHSA-pq6j-qmr3-jc6p

SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to …

Published Apr 19, 2016 · Updated Aug 6, 2024 · Assigned by mitre

Description

SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/UserAjax.getUsersList.dwr.

References

http://dotcms.com/security/SI-32
20160404 DotCMS injection Vulnerability mailing-list
http://packetstormsecurity.com/files/136548/DotCMS-3.3-SQL-Injection.html
20160404 SQL Injection Vulnerability in DotCms v3.3 mailing-list