Description

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T14:17:10.073Z",
  "pubdate": "2026-10-12T14:17:10.073Z",
  "executiveSummary": "LogicalDOC Community Edition versions through 9.3 are susceptible to a critical SQL injection vulnerability residing within the TagsDataServlet component.\nThe flaw stems from improper neutralization of user-supplied input provided via the firstLetter parameter, which is concatenated directly into database queries.\nThis vulnerability enables an authenticated attacker with low-level privileges to bypass standard application logic and execute arbitrary SQL statements.\nSuccessful exploitation allows for the unauthorized extraction of sensitive data from the underlying database, including, but not limited to, usernames, email addresses, and cryptographic password hashes stored within the ld_user table.\nThe impact is significant, as an attacker can potentially escalate privileges or gain complete control over user accounts by compromising credentials.\nExploitation requires the attacker to possess a valid authenticated session, although the privileges required for the initial authentication are minimal.\nThe vulnerability poses a severe risk to data confidentiality and integrity, necessitating immediate attention to prevent unauthorized data exfiltration.",
  "technicalDetails": "The vulnerability is located in the TagsDataServlet, which handles requests related to document tagging functionalities in LogicalDOC Community Edition.\nThe root cause is an improper input sanitization mechanism applied to the firstLetter HTTP parameter before it is integrated into a SQL query string. The application fails to utilize parameterized queries or adequate input validation, allowing malicious SQL syntax to be interpreted by the database engine.\nThe exploitation flow begins when an authenticated user sends a crafted HTTP request to TagsDataServlet. By manipulating the firstLetter parameter, an attacker can inject malicious SQL commands, specifically leveraging the UNION SELECT operator to pivot the execution context.\nWhen the server processes the request, the database executes the attacker-supplied query in conjunction with the legitimate application query. The results of the injected UNION SELECT statement are then serialized by the servlet into the XML response returned to the client.\nThis behavior allows the attacker to retrieve sensitive information from arbitrary tables, such as the ld_user table, by observing the XML-formatted data returned in the response stream.\nThe impact is a full disclosure of user records, including authentication metadata. Because password hashes are extracted, the attacker may perform offline brute-force or dictionary attacks to recover plaintext credentials, leading to a total compromise of user accounts and potentially administrative access.\nThe vulnerability exists in all versions of LogicalDOC Community Edition through 9.3. There is no evidence of robust sanitization libraries or Web Application Firewall (WAF) rule sets deployed by default to neutralize such vectors within this specific endpoint.\nThe attack is persistent and reliable, requiring only the ability to reach the servlet with a valid session cookie, making it a high-utility vector for internal threat actors or compromised low-privileged accounts."
}