CVE-2025-45868
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability in LogicalDOC Enterprise up to version 9.1.1 allows an authenticated attacker to perform blind SQL injection in the ComparisonServlet component. Crafted input can be used to manipulate SQL queries.
Risk Assessment
An attacker can unauthorizedly read, modify, or delete data in the database, compromising the confidentiality and integrity of the organization's data.
Recommendation
Immediately update LogicalDOC Enterprise to the latest available version that includes a fix for the SQL injection vulnerability.
Other vulnerabilities in LogicalDOC Enterprise
See all- CVE-2025-45870Medium
Local File Inclusion (LFI) vulnerability in LogicalDOC Enterprise up to and including version 9.1.1, present in the OnlyOfficeEditor servlet. Allows an authenticated user to exploit a path traversal flaw in the fileExt parameter to read files outside allowed directories.
- CVE-2025-45869High
LogicalDOC Enterprise versions up to 9.1.1 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.
Original NVD description (English source)
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.