CVE-2020-10365

MEDIUM

LogicalDoc < 8.3.3 - Authenticated SQL Injection via Document List Filter Parameters

Title source: llm

Description

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary queries to the database.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://www.coresecurity.com/advisories/logicaldoc-virtual-appliance-multiple-vulnerabilities

Scores

CVSS v3 6.5

EPSS 0.0126

EPSS Percentile 66.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-89

Status published

Products (1)

logicaldoc/logicaldoc < 8.3.3

Published Mar 18, 2020

Tracked Since Feb 18, 2026