Security flaw in version 3.1.2.1 0

Software Support
1

This version has a security flaw and is susceptible to Cross Site Scripting attacks. Has this flaw been fixed in the new version?

2

Hi @wandson,

Can you be more specific about the flaw? Is this something that has been disclosed publicly, or something that you have found? (If the details after sensitive, please send me a private message.)

Regards,
Alec Smecher
Public Knowledge Project Team

1 Like
3

Hi @asmecher,

In my structure I use version 3.1.2.1 and recently I was the target of a Cross Site Scripting attack. The hacker made a simple attack left an image, that is, his mark.
I received a report from our intelligence stating that OJS has many vulnerabilities.
My server is very safe, even though it was the target of this attack where this hacker exploited this vulnerability of the tool.
This same hacker continues to carry out Cross Site Scripting attacks on various companies and government agencies exploiting this same vulnerability.
So I ask if this could be fixed in the next version.
I’m talking about Brazil here and I apologize for the English.

4

Hi @wandson,

I think you might be talking about this subject: There is any known vulnerability that allows remote file inclusion?

If it is the same, it’s not a vulnerability.

Regards,
Alec Smecher
Public Knowledge Project Team

5

If it is not a vulnerability what would it be? A hacker group from Morocco is using this feature to invade several companies and a Brazilian government agency that uses the tool.

6

Hi @wandson,

There is a feature in OJS that allows users to upload images to use in their biographies, abstracts, etc. The so-called hacker is registering an account, using this feature to upload an image, then showing this image as evidence of a hack. This is roughly equivalent to uploading an image to this forum containing a message about hacking. The ability to upload images is intentional in both cases and not a vulnerability.

Regards,
Alec Smecher
Public Knowledge Project

7

@asmecher,

I looked at the link you provided and understood. Thanks a lot for the help.

That link, https://pkp.sfu.ca/2017/04/12/regarding-recent-ojs-defacement-attacks/

1 Like