Technical impact
The vulnerability is a blind SQL injection in the ComparisonServlet of LogicalDOC Enterprise. An authenticated user can craft requests that are incorporated directly into SQL statements, giving the attacker the ability to read, modify, or delete data held in the underlying database. Because the data is accessed by an authenticated endpoint, the injection does not require unauthenticated access, but it means that any legitimate servlet is a potential attack vector. No indication of remote code execution is provided, but the ability to manipulate arbitrary queries poses a serious risk to the confidentiality and integrity of stored documents and metadata. Based on the description, it is inferred that the flaw could be used to exfiltrate sensitive documents.
Affected Systems
LogicalDOC Enterprise, versions 9.1.1 and earlier, is affected by this blind SQL injection vulnerability. The affected component is the ComparisonServlet, part of the web application used to compare documents. Users of the Enterprise edition who have logged into the system and have access to this servlet are at risk. Versions subsequent to 9.1.1 are presumed to include the fix, although verification is required. It is inferred that all installations using version 9.1.1 or older are affected.
Risk and Exploitability
Although the vulnerability is not listed in the CISA KEV catalog, its EPSS score of < 1% indicates a very low probability of exploitation. The vendor’s CVSS score of 8.8 categorizes the blind SQL injection as high severity. The attack requires authentication; any user with valid credentials can exploit the flaw by sending specially crafted input to the ComparisonServlet. If successful, the attacker could read sensitive documents, alter records, or potentially delete data. The lack of publicly available exploit code or reported usage indicates that exploitation may not yet be widespread. Based on the lack of publicly available exploit code, it is inferred that exploitation is not widespread, but the vulnerability remains exploitable by insiders or compromised user accounts.
