CVE-2025-8311

CVE-2025-8311 is a critical Boolean-based blind SQL injection vulnerability affecting dotCMS versions 24.03.22 and later, specifically within the /api/v1/contenttype endpoint. An authenticated, low-privileged attacker can exploit this by manipulating the 'sites' query parameter, which is directly concatenated into SQL queries without proper sanitization. This allows for full database exfiltration, privilege escalation, and denial-of-service conditions, as confirmed by tools like SQLMap. The vulnerability has a CVSS score of 9.4 (CRITICAL) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not actively exploited in the wild or listed in CISA KEV, an ExploitDB entry (EDB-52431) exists, and the vulnerability has minimal community discussion or media coverage.