Seeddms 5.1.22 Exploit May 2026

Recursively search for PHP files in the data/ directory:

find /var/www/seeddms/data -name "*.php" -type f

(Note: SeedDMS never stores legitimate PHP files there.) seeddms 5.1.22 exploit

Check for abnormally small or obfuscated files: Recursively search for PHP files in the data/

find /var/www/seeddms/data -type f -size -10k -exec grep -l "eval\|system\|base64_decode" {} \;

A complete attacker workflow for SeedDMS 5.1.22: (Note: SeedDMS never stores legitimate PHP files there

The most dangerous vulnerability in SeedDMS 5.1.22 is a Time-Based Blind SQL Injection found in the op/op.RemoveDocument.php and op/op.RemoveFolder.php endpoints. The issue arises because user-supplied input via the documentid or folderid parameter is directly concatenated into SQL queries without sanitization or parameterized queries.

Specifically, the code snippet from op.RemoveDocument.php (simplified):

$documentid = (int) $_GET['documentid']; // Insufficient casting bypass
$query = "SELECT * FROM `tblDocuments` WHERE `id` = " . $_GET['documentid'];

Attackers can bypass the (int) cast using SQL comment characters or encoding tricks, leading to classic Boolean/Time-based injection.