PT-2025-7800 · Public Knowledge · Ojs+2

Muhammad Hendra · Published 2025-02-24 · Updated 2025-03-03 · CVE-2024-56525

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Public Knowledge Project (PKP) OJS versions prior to 3.3.0.21 Public Knowledge Project (PKP) OMP versions prior to 3.3.0.21 Public Knowledge Project (PKP) OPS versions prior to 3.3.0.21 Public Knowledge Project (PKP) OJS versions 3.4.x prior to 3.4.0.8 Public Knowledge Project (PKP) OMP versions 3.4.x prior to 3.4.0.8 Public Knowledge Project (PKP) OPS versions 3.4.x prior to 3.4.0.8

Description The issue allows an XXE attack by the Journal Editor Role, enabling the creation of a new role as super admin in the journal context and the insertion of a backdoor plugin. This is achieved by uploading a crafted XML document as a User XML Plugin.

Recommendations For Public Knowledge Project (PKP) OJS, OMP, and OPS versions prior to 3.3.0.21, update to version 3.3.0.21 or later. For Public Knowledge Project (PKP) OJS, OMP, and OPS versions 3.4.x prior to 3.4.0.8, update to version 3.4.0.8 or later. As a temporary workaround, consider restricting the upload of XML documents as User XML Plugins to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-56525

Affected Products

Ojs

Omp

Ops

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-56525 · Security Note
• https://twitter.com/cybercronai/status/1895142761692557488 · Twitter Post
• https://twitter.com/CVEnew/status/1894163899416449436 · Twitter Post
• https://twitter.com/taqtics_ai/status/1896536056045940921 · Twitter Post
• https://t.me/cvenotify/112360 · Telegram Post
• https://t.me/cvedetector/18845 · Telegram Post
• https://openjournaltheme.com/user-xml-fatal-vulnerabilities-for-ojs-omp-ops-3-3-0-21-cve-2024-56525 · Note