LogicalDOC Enterprise: Blind SQL injection in WorkflowsDataServlet
Summary
LogicalDOC Enterprise up to and including version 9.1.1 contains a blind SQL injection flaw in the WorkflowsDataServlet component. An authenticated user can create a workflow template with a crafted name that is used unsanitized in an SQL query, and then extract database contents such as user records, email addresses and password hashes character by character through the boolean response. Exploitation requires a valid user account.
Affected
- LogicalDOC Enterprise up to and including 9.1.1
Fixed in
Unknown. The vendor has indicated that the fix is planned for LogicalDOC 9.2. Ask the vendor in writing whether the fixed build addresses this CVE.
Workaround
- No vendor-published workaround known.
- Restrict access to the web interface (VPN, IP allowlist or SSO-only access).
- Limit the database account's privileges.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not known to be exploited (KEV: No).
- A public proof of concept may exist in a researcher's repository. This could not be verified.
Our recommendation
- Identify all LogicalDOC instances and their exact versions.
- Treat 9.1.1 and older as high priority, as the 9.1.x line is reportedly out of support.
- Check whether the DMS is reachable from the internet and restrict access (VPN, IP allowlist or SSO).
- Review user accounts, remove dormant ones, and enforce strong passwords and MFA.
- Monitor application logs for unusual workflow-related requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub: Vulnerability-Disclosure CVE-2025-45871 (netero1010) github.com
- LogicalDOC 9.1.x phase-out notice www.logicaldoc.de
- Strix CVE entry CVE-2025-45871 www.strix.ai
- CISA ADP vulnrichment record CVE-2025-45871 hol.org
- LogicalDOC www.logicaldoc.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:47.
Original description (NVD)
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.