Description
Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
LogicalDOC LogicalDOC Community
Default version status: unaffected
0 to < 9.1affected
LogicalDOC LogicalDOC Enterprise
Default version status: unaffected
0 to < 9.1affected