Description
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
LogicalDOC LogicalDOC Community Edition
Default version status: unaffected
0 to ≤ 9.3affected
References
- https://github.com/logicaldoc/community/discussions/119 ↗
- https://github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aee ↗
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java#L691 ↗
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java#L41 ↗
- https://github.com/logicaldoc/community ↗
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-sql-injection-via-tags-xml-firstletter ↗