LogicalDOC Blind SQL Injection Vulnerability in Login Functionality

A blind SQL injection vulnerability has been identified in the login functionality of LogicalDOC document management system. This vulnerability can be exploited by unauthenticated attackers, but requires the Login Throttling feature to be enabled. By using a time-based blind SQL injection technique, an attacker could potentially access all database contents. Additionally, depending on the data in certain database tables, this vulnerability could lead to account takeover.

Impact

Exploitation of this vulnerability allows for the disclosure of all database contents. There is a potential for account takeover, depending on the presence of entries in specific database tables.

Remediation

This vulnerability has been addressed in LogicalDOC Community and Enterprise Editions version 9.1.