medium6.1Public exploit code
CVE-2019-12801
out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting2019-06-24 · webapps · php
Impact
out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Seeddms | Seeddms | Version 5.1.11 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/153384/SeedDMS-out.GroupMgr.php-Cross-Site-Scripting.html
- https://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG
- http://packetstormsecurity.com/files/153384/SeedDMS-out.GroupMgr.php-Cross-Site-Scripting.html
- https://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG