CVE-2024-54446 - CVE House
Back to Database
Status published High CVE-2024-54446

Blind SQLi in Document History

Vulnerability Description

Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-54446

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Matthew Hogg

References

More from LogicalDOC

View All →
CVE-2025-12547
LogicalDOC Community Edition Admin Login login.jsp excessive authentication
Medium 6.3
CVE-2025-12546
LogicalDOC Community Edition API Key creation UI cross site scripting
Medium 5.1
CVE-2025-11946
LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting
Medium 5.1
CVE-2024-54449
Remote Code Execution (RCE) via Arbitrary File Write In Document API
High 8.7
CVE-2024-54448
Remote Code Execution (RCE) via Automation Scripting
High 8.6

Affected Vendor

Affected Software

LogicalDOC Community, LogicalDOC Enterprise
Vulnerable Versions:
0

Timeline

Official Publish: March 14th, 2025
Last Modified: March 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact