CVE-2019-12801 in SeedDMS
Summary
by MITRE
out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2025
The vulnerability CVE-2019-12801 represents a critical stored cross-site scripting flaw in SeedDMS version 5.1.11, specifically within the out/out.GroupMgr.php component. This issue allows authenticated attackers to inject malicious JavaScript code through the GROUP name parameter when creating new groups, creating a persistent security risk that affects all users interacting with the vulnerable system. The flaw stems from inadequate input validation and output sanitization mechanisms within the group management functionality, enabling attackers to execute arbitrary scripts in the context of other users' browsers.
The technical implementation of this vulnerability occurs when the application fails to properly sanitize user input before storing and subsequently rendering group names in the web interface. When an attacker creates a new group with a malicious JavaScript payload in the GROUP name field, the system stores this data without adequate filtering or encoding. Subsequently, whenever other users view the group list or related pages, the malicious script executes in their browsers, potentially leading to session hijacking, data theft, or further exploitation. This stored XSS vulnerability operates at the application layer and can be leveraged by attackers who have already gained authentication access to the system.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to escalate privileges and compromise the entire SeedDMS environment. Once an attacker successfully injects malicious code through a group name, they can potentially access sensitive documents, modify group memberships, or execute commands on behalf of other users. The vulnerability affects the confidentiality, integrity, and availability of the system by allowing persistent malicious code execution, which can be particularly dangerous in enterprise environments where document management systems contain sensitive corporate data. The attack requires only basic authentication privileges to the SeedDMS system, making it an attractive target for both internal and external threat actors.
Security mitigations for CVE-2019-12801 should focus on implementing comprehensive input validation and output encoding mechanisms throughout the SeedDMS application. The most effective immediate solution involves sanitizing all user-provided input, particularly when creating group names, by applying strict validation rules and HTML encoding to prevent script execution. Organizations should also implement proper access controls and monitoring to detect suspicious group creation activities. The vulnerability aligns with CWE-79 which categorizes cross-site scripting flaws, and maps to ATT&CK technique T1059.007 for scripting languages, specifically targeting web application vulnerabilities. Regular security updates and patches should be applied immediately, as the vendor has likely released fixes for this specific vulnerability. Additionally, implementing Content Security Policy headers and regular security audits can help prevent similar issues in other components of the system, ensuring comprehensive protection against persistent XSS threats that could compromise the entire document management infrastructure.