CVE-2024-54447
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| LogicalDOC | LogicalDOC Community | 0 < 9.1 | affected |
| LogicalDOC | LogicalDOC Enterprise | 0 < 9.1 | affected |
Weaknesses
- CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Workarounds
This vulnerability has been mitigated in LogicalDOC Community and Enterprise Editions version 9.1 by commit e7cd313.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.