Headline
CVE-2022-28051: Responsible-Vulnerability-Disclosure/README.md at main · looCiprian/Responsible-Vulnerability-Disclosure
The “Add category” functionality inside the “Global Keywords” menu in “SeedDMS” version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.
CVE****Description
SeedDMS versions 6.0.18 and 5.1.25 are prone to stored XSS. The “Add category” functionality inside the “Global keywords” menu does not sanitize user input allowing javascript injection.
POC
Injecting the payload
By pressing the “Add category” button the malicious payload is saved and triggered by the application
Remediation
Escape user input by using “htmlspecialchars” php function
Reference
https://sourceforge.net/p/seeddms/code/ci/6fc17be5d95e8f00fbe5c124c4acd377fa2ce69d/
Timeline
- [22/03/2022] Vulnerability evidence sent to the vendor
- [23/03/2022] Vulnerability confirmed by the vendor
- [23/03/2022] Vulnerability fixed by the vendor
Notes
Thanks to the main developer of SeedDMS, Uwe Steinmann, that immediately acknowledged the vulnerability and fixed it.