SQL Injection in Logicaldoc Community

CVE-2024-12245

Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depend…

Vulnerability class: SQL Injection

EPSS: 0.003 (26.8th percentile) — read the EPSS interpretation.

Affected products

Logicaldoc Community — versions 0
Logicaldoc Enterprise — versions 0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

disclosure@synopsys.com (third-party-advisory)