If you're running SeedDMS 5.1.22, it's crucial to take immediate action to protect your system. If you're unsure about how to proceed, consider consulting with a security expert or the SeedDMS community.

uid=33(www-data) gid=33(www-data) groups=33(www-data)

After conducting a thorough analysis of SeedDMS 5.1.22, we discovered a critical vulnerability that allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive information. The vulnerability resides in the OutOut.php file, specifically in the ajax_ folder .

SeedDMS stores uploaded files in:

One of the most notable reports regarding SeedDMS 5.1.22 involves a comprehensive penetration test that chain-exploited multiple vulnerabilities to achieve full system takeover.

SeedDMS 5.1.22 is vulnerable to a critical SQL injection attack, allowing an attacker to gain unauthorized access to sensitive information. We have provided a proof-of-concept exploit and recommendations for mitigation. It is essential for organizations using SeedDMS to take immediate action to prevent exploitation of this vulnerability.