{"id":"CVE-2025-8311","published":"2025-09-04T14:12:42Z","modified":"2025-09-11T14:43:50Z","title":"dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype…","vendor":"dotCMS","product":"dotCMS Cloud Services (dCS)","tier":"core","eol":null,"affectedVersions":[{"vendor":"dotCMS","product":"dotCMS Cloud Services (dCS)","versions":["24.03.22+"]}],"description":{"text":"dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which accepts a comma-separated list of site identifiers or keys.\n\nThe vulnerability was triggered via the sites parameter, which was directly concatenated into a SQL query without proper sanitization. \n\nExploitation allowed an authenticated attacker with low privileges to extract data from database, perform privilege escalation, or trigger denial-of-service conditions. \n\nThe vulnerability was verified using tools such as SQLMap and confirmed to allow full database exfiltration and potential denial-of-service conditions via crafted payloads.\n\nThe vulnerability is fixed in the following versions of dotCMS stack: 25.08.14 / 25.07.10-1v2 LTS / 24.12.27v10 LTS / 24.04.24v21 LTS","provenance":"source","from":"CVE.org"},"summary":{"text":"A Boolean-based blind SQL injection flaw exists in the /api/v1/contenttype endpoint of dotCMS Cloud Services (dCS), where the sites query parameter is concatenated directly into a SQL query without sanitization. An attacker with network access and low-privilege authenticated credentials, requiring no user interaction, can extract data from the database, escalate privileges, or trigger denial-of-service conditions.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-11-01T01:04:23Z"},"cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01709,"percentile":0.77332,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-09-04","exploitedFirstSeen":"2025-09-04","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8311","date":"2025-09-04"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-73","tags":["vendor-advisory","issue-tracking","related"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-27276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27276","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52431,"url":"https://www.exploit-db.com/exploits/52431","title":"dotCMS 25.07.02-1 - Authenticated Blind SQL Injection","type":"webapps","platform":"multiple","date":"2025-09-16","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-09-16"},"first":{"date":"2025-09-16","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52431"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-09-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-8311","provenance":"source"},{"date":"2025-09-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2025-8311","provenance":"source"},{"date":"2025-09-16","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-52431)","url":"https://www.exploit-db.com/exploits/52431","provenance":"source"}],"speed":{"daysToPublicExploit":12,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":62.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 423 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.47,"detail":"percentile 0.7733"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.58,"detail":"base score 9.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}