LogicalDOC Blind SQL Injection Vulnerability in Saved Search Functionality

A blind SQL injection vulnerability has been identified in the saved search functionality of LogicalDOC document management system. This vulnerability can be exploited by authenticated attackers using a time-based blind SQL injection technique, potentially leading to the disclosure of all database contents. Depending on the presence of certain entries in the database, this vulnerability could also result in account takeover.

Impact

Exploitation of this vulnerability allows authenticated attackers to use time-based blind SQL injection techniques to access and disclose all database contents. Additionally, there is a potential for account takeover, depending on the presence of specific entries in certain database tables.

Remediation

This vulnerability has been mitigated in both LogicalDOC Community and Enterprise Editions version 9.1.