Test ID:	1.3.6.1.4.1.25623.1.0.106614
Category:	Web application abuses
Title:	dotCMS H2 Database RCE Vulnerability - Active Check
Summary:	dotCMS is prone to a remote code execution (RCE) vulnerability; if used with the default H2 database.
Description:	Summary: dotCMS is prone to a remote code execution (RCE) vulnerability if used with the default H2 database. Vulnerability Insight: dotCMS offers a Tomcat server with a preconfigured dotCms installation which uses the H2 database. The getCreateSortChildren() function of the 'H2CategorySQL' class suffers of an SQL injection vulnerability into the 'inode' parameter of a GET request, when the 'reorder' parameter is set to 'TRUE'. Affected Software/OS: All dotCMS installations when using the H2 database. Solution: dotCMS will not fix this vulnerability since the H2 database is just for testing and trying out and is not recommended or supported in a productive environment. Please change the used database to something else than H2 and restrict access to 'categoriesServlet'. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.