CVEs-PoC/2021/CVE-2021-36543.md

### [CVE-2021-36543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36543)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.

### POC

#### Reference
- https://cyberdivision.medium.com/cve-2021-36543-9622f50c6dc

#### Github
No PoCs found on GitHub currently.