Description (CNA)
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| LogicalDOC / LogicalDOC Community Edition | affected 0 through 9.3 |
CWE
CWE-89
References
- https://github.com/logicaldoc/community/discussions/119
- https://github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aee
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java#L691
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java#L41
- https://github.com/logicaldoc/community
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-sql-injection-via-tags-xml-firstletter
ADP enrichment
No English description supplied.
No references supplied.