Published: 06/09/2012 Updated: 12/01/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 440

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems prior to 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pkp open journal systems

Open Journal Systems version 236 suffers from file manipulation, cross site scripting, and shell upload vulnerabilities ...

source: wwwsecurityfocuscom/bid/52666/info Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input: 1 An arbitrary-file-deletion vulnerability 2 A security vulnerability 3 An arbitrary-file-upload vulnerability 4 Multiple cross-site scripting vuln ...

source: wwwsecurityfocuscom/bid/52666/info Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input: 1 An arbitrary-file-deletion vulnerability 2 A security vulnerability 3 An arbitrary-file-upload vulnerability 4 Multiple cross-site scripting vulner ...

CWE-79 http://archives.neohapsis.com/archives/bugtraq/2012-03/0102.html http://www.osvdb.org/80257 http://secunia.com/advisories/48449 http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431 http://pkp.sfu.ca/ojs/RELEASE-2.3.7 http://www.osvdb.org/80255 https://www.htbridge.com/advisory/HTB23079 http://secunia.com/advisories/48464 http://www.osvdb.org/80256 https://exchange.xforce.ibmcloud.com/vulnerabilities/74227 https://exchange.xforce.ibmcloud.com/vulnerabilities/74226 https://exchange.xforce.ibmcloud.com/vulnerabilities/74225 https://exchange.xforce.ibmcloud.com/vulnerabilities/74228 https://nvd.nist.gov https://packetstormsecurity.com/files/111073/Open-Journal-Systems-2.3.6-XSS-File-Manipulation-Shell-Upload.html https://www.exploit-db.com/exploits/37000/

CVE-2012-1469

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect