CVE-2016-8907

2016-11-14T23:20:00
ID CVE-2016-8907
Type cve
Reporter cve@mitre.org
Modified 2016-11-29T19:20:00

Description

SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.