CVE-2021–26216

# Exploit Title: SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php
# Date: 15/03/21
# Exploit Author: Tuhin Bose
# Vendor Homepage: https://www.seeddms.org/
# Version: 5.1.x
# CVE : CVE-2021–26216

SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php that allows an attacker to edit victim’s documents. To exploit this vulnerability, an attacker has to host the html code in his server and send the link to victim.

Steps to reproduce:

1. Visit the edit folder page.
2. Add one document
3. Capture the request using burp and right click on the request and click on “Engagement tools” “Generate CSRF poc”
4. Copy the html code and save it as csrf.html on your server.