CVE-2017-5344

An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Overcoming these controls permits a number of blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.

• CWE-89

• http://dotcms.com/security/SI-39Vendor Advisory
• http://seclists.org/fulldisclosure/2017/Feb/34Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/96259
• https://github.com/xdrr/webapp-exploits/blob/master/vendors/dotcms/2017.01.blind-sqli/dotcms-dump.shExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/41377/
• http://dotcms.com/security/SI-39Vendor Advisory
• http://seclists.org/fulldisclosure/2017/Feb/34Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/96259
• https://github.com/xdrr/webapp-exploits/blob/master/vendors/dotcms/2017.01.blind-sqli/dotcms-dump.shExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/41377/

Published

Feb 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5337Multiple heap-based buffer overflows in the read_attribute f…
• CVE-2017-5338Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-5339Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-5340Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1…9.8
• CVE-2017-5341The OTV parser in tcpdump before 4.9.0 has a buffer overflow…
• CVE-2017-5342In tcpdump before 4.9.0, a bug in multiple protocol parsers …
• CVE-2017-5345SQL injection vulnerability in inc/lib/Control/Ajax/tags-aja…
• CVE-2017-5346SQL injection vulnerability in inc/lib/Control/Backend/posts…
• CVE-2017-5347SQL injection vulnerability in inc/mod/newsletter/options.ph…
• CVE-2017-5350Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) sof…
• CVE-2017-5351Samsung Note devices with KK(4.4), L(5.0/5.1), and M(6.0) so…
• CVE-2017-5356Irssi before 0.8.21 allows remote attackers to cause a denia…