Blind SQL Injection in LogicalDOC Enterprise

Executive Summary

CVE-2025-45868 is a blind SQL injection vulnerability in LogicalDOC Enterprise versions up to 9.1.1. It affects the ComparisonServlet component, specifically the /compare endpoint which processes parameters like docId1, docId2, fileVersion1, and fileVersion2. The vulnerability arises because fileVersion1 and fileVersion2 are used to build an HQL query without proper sanitization or parameter binding, allowing authenticated users to inject crafted expressions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the /compare endpoint with parameters like docId1, docId2, fileVersion1, and fileVersion2. Look for unusual SQL-like expressions in these parameters. Use tools like Burp Suite or sqlmap to test for blind SQL injection by sending crafted inputs and observing error responses or PDF generation.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could exploit this to manipulate SQL queries and infer database values character by character. This may expose sensitive data such as usernames, email addresses, password hashes, or other confidential records. The attack could lead to information disclosure and potential privilege escalation within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive personal data, violating compliance requirements under GDPR and HIPAA. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A breach could result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to LogicalDOC 9.2 or apply the vendor patch. Ensure HQL/SQL queries use parameterized inputs and validate fileVersion1 and fileVersion2 strictly. Restrict access to the /compare endpoint to authorized users only and monitor for suspicious activity.

Useful 0 Not Useful 0