CVE-2017-5344

🗓️ 17 Feb 2017 07:45:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 91 Views🌐 WEB

An issue in dotCMS 3.6.1 allows blind boolean SQL injection via /categoriesServlet

Reporter	Title	Published	Views	Family All 14
zdt	dotCMS 3.6.1 Blind Boolean SQL Injection Vulnerability	18 Feb 201700:00	–	zdt
Circl	CVE-2017-5344	16 Feb 201700:00	–	circl
CNVD	DotCMS SQL Injection Vulnerability (CNVD-2017-01933)	16 Feb 201700:00	–	cnvd
Cvelist	CVE-2017-5344	17 Feb 201707:45	–	cvelist
Exploit DB	dotCMS 3.6.1 - Blind Boolean SQL Injection	16 Feb 201700:00	–	exploitdb
EUVD	EUVD-2017-14449	7 Oct 202500:30	–	euvd
exploitpack	dotCMS 3.6.1 - Blind Boolean SQL Injection	16 Feb 201700:00	–	exploitpack
Mend	CVE-2017-5344	17 Feb 201707:45	–	mend
NVD	CVE-2017-5344	17 Feb 201707:59	–	nvd
Packet Storm	dotCMS 3.6.1 Blind Boolean SQL Injection	15 Feb 201700:00	–	packetstorm

NVD

Node

dotcms dotcmsRange≤3.6.1

Source	Link
securityfocus	www.securityfocus.com/bid/96259
dotcms	www.dotcms.com/security/SI-39
exploit-db	www.exploit-db.com/exploits/41377/
seclists	www.seclists.org/fulldisclosure/2017/Feb/34
github	www.github.com/xdrr/webapp-exploits/blob/master/vendors/dotcms/2017.01.blind-sqli/dotcms-dump.sh

Parameter	Position	Path	Description	CWE
q	query param	/categoriesServlet	Blind boolean SQL injection in q and inode parameters of /categoriesServlet.	CWE-89
inode	query param	/categoriesServlet	Blind boolean SQL injection in q and inode parameters of /categoriesServlet.	CWE-89

17 Jun 2026 01:20Current

9.8Critical risk

Vulners AI Score9.8

CVSS 27.5

CVSS 39.8

EPSS0.06304