SQL Injection in ojs 3.3.0-11

[kunalojs]

Hi,
After some security tests carried out on my site (developed in OJS 3.3.0-11), one of the vulnerabilities detected was that SQL injection is possible.
Payload Used: 0’XOR(if(now()=sysdate(),sleep(15),0))XOR’Z

How can i solve this problem?

[rcgillis]

Hi @kunalojs,

As per your other post, please use the protocol found here for reporting security issues: ojs/SECURITY.md at main · pkp/ojs · GitHub

-Roger
PKP Team

[asmecher]

Hi @kunalojs,

See this thread:

SQL Injection (Time-Based)

Describe the issue or problem How to fixed Sql injection URL:- ‘localhost/ojs/index.php/index/login’ Click on 'username and password and captcha ’ 3 . Ojs version , OJS 3.1.1-4 [screen.audit.png] PFA error :Payload Used: %27%2b((SELECT+1+FROM+(SELECT+SLEEP(25))A))%2b%27+%2f*+9808 9e48-3a9f-4a56-a4c5-1b599701c710+*%2f Modify the Login request and insert the Time based SQL query (%27%2b((SELECT+1+FROM+(SELECT+SLEEP(25))A))%2b%27+%2f*+980 89e48-3a9f-4a56-a4c5-1b599701c710+*%2f) i…

Either your OJS has been modified in an unsafe way, or you are using a security tool that presents a false positive for SQL injections.

If you’re able to demonstrate otherwise, please provide more details and I’ll have a look.

Regards,
Alec Smecher
Public Knowledge Project Team