LogicalDOC Blind SQL Injection Vulnerability in Document History Functionality

A blind SQL injection vulnerability has been identified in the document history feature of LogicalDOC, affecting both the Community and Enterprise editions. This vulnerability can be exploited by authenticated attackers using a time-based blind SQL injection technique, potentially leading to the disclosure of all database contents. Depending on the entries in certain database tables, account takeover could also be a possible outcome.

Impact

Exploitation of this vulnerability allows for the disclosure of all database contents. Additionally, account takeover is a potential risk, depending on the presence of specific entries in certain database tables.