Vulnerability in LogicalDOC Community Edition

[ Description ]Official description

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/logicaldoc/community
• github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/c…
• github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc…
• github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aee
• github.com/logicaldoc/community/discussions/119
• www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-sql-injection-via…