EUVD-2025-211038
GHSA-4rc8-5r37-q92m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySubmit crafted workflow template name
-
ExploitPayload injected into WorkflowsDataServlet SQL
-
ExecutionBlind boolean/time-based inference
-
ImpactExfiltrate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated LogicalDOC Enterprise account (any user able to reach and submit to the WorkflowsDataServlet workflow-template functionality); no administrative role, no victim user interaction, and no special non-default configuration is indicated by the description. The injection is reached specifically through the workflow template name parameter, so exploitation depends on the attacker being able to create or supply a workflow template. The primary limiting factor is the authentication requirement (PR:L) - this is not an unauthenticated internet-facing flaw - which, combined with the product's niche deployment, narrows realistic exposure to insiders or attackers who have already obtained credentials. |
| Impact | This is a credible but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity blind SQL injection (CWE-89) requiring only low-privilege authentication, with high confidentiality and integrity impact but no availability impact (8.1/High) - consistent with the description's 'authenticated user' precondition. Signal cross-reference shows tension: the EPSS score is very low (0.17%, 5th percentile), the CVE is NOT in CISA KEV, and there is no evidence of active exploitation, yet a dedicated vulnerability-disclosure repository (netero1010) is referenced, indicating public technical detail and likely proof-of-concept exists. The low EPSS alongside a public disclosure is explained by prevalence: LogicalDOC Enterprise is a niche document-management product, so broad opportunistic scanning is unlikely even though the technique itself is well understood and reliable. No signals conflict with the CVSS vector. Key caveat: the affected-version metadata is effectively missing - CPE is a malformed placeholder (cpe:2.3:a:n/a:n/a) and EUVD lists 'n/a n/a' - so 'up to and including 9.1.1' comes only from the MITRE description text and should be verified with LogicalDOC directly. |
| Exploit ScenarioDerived | An attacker with any valid low-privilege LogicalDOC Enterprise account creates or names a workflow template containing a crafted SQL payload, which the WorkflowsDataServlet concatenates into a backend query. Because the injection is blind, the attacker uses boolean/time-based inference to extract data such as credentials, document metadata, or other tenants' records from the database. Public disclosure material exists in the referenced netero1010 repository, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Blind SQL injection in LogicalDOC Enterprise up to and including 9.1.1 lets an authenticated user inject arbitrary SQL through the workflow template name parameter processed by the WorkflowsDataServlet, potentially exposing or tampering with the backend database that stores documents and metadata. Exploitation requires a valid account that can create or submit a workflow template (PR:L; no administrative role, no victim interaction), so realistic exposure is limited to insiders or attackers who already hold credentials against a niche document-management deployment. EPSS is low at 0.17% (5th percentile), the product is not in CISA KEV, and no public exploit has been identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the provided data, so the primary action is to check LogicalDOC's site (https://www.logicaldoc.com/) and the tracking advisories (https://nvd.nist.gov/vuln/detail/CVE-2025-45871, https://vuldb.com/vuln/414371) for a release newer than 9.1.1 and upgrade once it is available. Until then, restrict the ability to create or submit workflow templates to the smallest set of trusted accounts, since the injection is reachable only through that authenticated template-name path; the trade-off is reduced workflow flexibility for ordinary users. Run the application against a least-privilege database account limited to the schemas LogicalDOC actually needs, which does not stop the injection but caps what an attacker can read or modify. Deploy WAF or reverse-proxy SQL-injection signatures on requests to WorkflowsDataServlet as a stopgap, accepting that signature evasion is possible and false positives may block legitimate template submissions. Finally, enable verbose database query logging and alert on anomalous SQL in the workflow-template code path to detect exploitation attempts, at the cost of additional log volume and storage.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 improper neutralization of special elements used in SQL commands, rated CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). LogicalDOC Enterprise is a Java servlet-based document management platform; the WorkflowsDataServlet constructs database queries that incorporate a user-supplied workflow template name without adequate parameterization, allowing an authenticated attacker to inject SQL. Because the injection is blind, an attacker typically infers data through boolean- or time-based responses rather than direct query output, which slows but does not prevent extraction. The network attack vector and low complexity mean no special conditions are needed beyond a valid session; the authentication requirement (PR:L) is the primary constraint, and the description does not indicate any non-default configuration dependency. Note that the provided CPE string is 'n/a' and the EUVD affected-version list is also 'n/a', so the only version boundary available from the input is the vendor-stated 'up to and for 9.1.1'.
Know when Logicaldoc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable servlet (AV:N) with reliable injection (AC:L) needs a low-privilege account (PR:L) and no interaction; SQLi yields full read and write to the DB (C:H/I:H) but no availability loss (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.
Executive ViewAI
LogicalDOC Enterprise versions up to and including 9.1.1 carry a high-severity blind SQL injection in the workflow template name parameter handled by WorkflowsDataServlet, meaning any user holding a valid account able to author or submit workflow templates can read or alter the contents of the document repository's backend database. Because the product is used as a system of record for contracts, intellectual property and regulated records, a single insider or compromised credential could quietly expose or corrupt organizational content without triggering user-facing errors. Leadership should care less about the niche deployment footprint and more about the sensitivity and integrity of the data the platform holds, and should note that no vendor patch is currently available and no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and audit accounts permitted to create or submit workflow templates; enforce MFA on those accounts; network-segment or firewall LogicalDOC so WorkflowsDataServlet is not reachable from untrusted networks; enforce web application firewall rules rejecting SQL metacharacters in the workflow template name parameter; run the backend database under a least-privilege service account; enable database activity monitoring and application error alerting to detect blind SQL injection attempts; and review logs for historical evidence of tampering or exfiltration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Logicaldoc
View allLogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. Rated high severity (CVSS
LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalati
A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Rated
LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-
LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and
LogicalDoc before 8.3.3 allows SQL Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitab
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document. Rated medium s
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticat
Unauthenticated multipart uploads to the LogicalDOC Community Edition /upload endpoint (through version 9.3) let remote
Authenticated remote code execution in LogicalDOC Community Edition through 9.3 allows any user with a valid account to
Missing authorization in LogicalDOC Community Edition through 9.3 allows any authenticated low-privilege user to disclos
Exploit-DB