Description
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Open Journal Systems (OJS) 2.3.6 - 'index.php?authors[][url]' Cross-Site Scripting EDB-36999 · webapps · Mar 21, 2012 · verified
- Open Journal Systems (OJS) 2.3.6 - '/lib/pkp/classes/core/String.inc.php?String::stripUnsafeHtml()' Method Cross-Site Scripting EDB-37000 · webapps · Mar 21, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431
- open-journal-articleid-xss(74228) vdb-entry
- open-journal-index-xss(74225) vdb-entry
- 48449 third-party-advisory
- http://pkp.sfu.ca/ojs/RELEASE-2.3.7
- open-journal-editor-xss(74227) vdb-entry
- 80257 vdb-entry
- https://www.htbridge.com/advisory/HTB23079
- 80255 vdb-entry
- 20120321 Multiple vulnerabilities in Open Journal Systems (OJS) mailing-list
- 48464 third-party-advisory
- 80256 vdb-entry
- open-journal-string-xss(74226) vdb-entry