Boolean-Based Blind SQL Injection in dotCMS by dotCMS

CVE-2025-8311

What is CVE-2025-8311?

The identified vulnerability allows authenticated attackers with minimal privileges to exploit a Boolean-based blind SQL injection through the /api/v1/contenttype endpoint of dotCMS. By manipulating the sites query parameter, it is possible to inject malicious SQL code, leading to unauthorized data extraction and potentially enabling denial-of-service conditions. The flaw arises from the inadequate sanitization of user inputs before they are concatenated into SQL queries. Security assessments using tools like SQLMap have confirmed this risk, underscoring the critical need for prompt updates to secure affected installations.

References