Logidalcad Community <=9.3.1: RCE, SSRF, Injection, Auth Bypass Vulnerabilities

Vulnerability Overview The webpage screenshot describes multiple high-severity vulnerabilities involving SQL injection, authentication bypass, IDORs, SSRF, and RCE patterns. Specifically: 1. SQL Injection: The filter in tag search is concatenated into raw SQL, leading to data leakage for low-privilege users. 2. HQL Injection: Query parameters in the document list index are directly concatenated into HQL, leading to query manipulation. 3. Authentication Bypass: Failure of only triggers , resulting in unauthorized access. 4. Unauthorized Temporary Upload: The method uses which falls back to an anonymous directory, leading to anonymous disk filling and exploitation. 5. Unauthorized Avatar Disclosure / User Object: is not verified; the parameter is read directly, allowing anonymous access to avatars and user objects. 6. Password Recovery Ticket Not Bound to User: Lookup is performed via , followed by a second lookup using the parameter, leading to arbitrary account reset. 7. IDOR - PDF Conversion Download: Only is verified; checks for are missing, allowing low-privilege users to download private PDFs. 8. IDORs - Document Copy / Delete Version / Reindex / Extract Text: is not verified, allowing low-privilege users to copy, delete, pollute indices, and disclose text. 9. Automation Velocity Sandbox Bypass - RCE: only blocks the string and the runtime regex, leading to RCE. 10. SSRF + XSLT via XML Converter: XML is obtained via , leading to malicious XSLT upload and transformation. 11. Converter Command Handling + Store Name Sanitize: writes converter paths/parameters, allowing reformatting, leading to Windows escape. Scope of Impact Affected Versions: Confirmed Versions: Private PoCs: Available Remediation SQL Injection: Ensure the filter is properly bound to prevent direct concatenation into SQL. HQL Injection: Use named parameter queries to prevent direct concatenation into HQL. Authentication Bypass: When fails, correctly invoke and . Unauthorized Temporary Upload: Verify to ensure returns a valid directory. Unauthorized Avatar Disclosure / User Object: Verify to ensure the parameter is valid. Password Recovery Ticket Not Bound to User: Ensure and parameters are bound, and disable ticket lookup. IDOR - PDF Conversion Download: Verify to prevent low-privilege users from downloading private PDFs. IDORs - Document Copy / Delete Version / Reindex / Extract Text: Verify to prevent low-privilege users from performing these actions. Automation Velocity Sandbox Bypass - RCE: Block the string and the runtime regex to prevent RCE. SSRF + XSLT via XML Converter: Use and ensure and settings are correctly configured. Converter Command Handling + Store Name Sanitize: Ensure proper sanitization of paths/parameters written by to prevent reformatting. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Logidalcad Community <=9.3.1: RCE, SSRF, Injection, Auth Bypass Vulnerabilities

More from this source