Unscored severity · published Sep 6, 2012
CVE-2012-1468
Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OJ
Open Journal Systems · Pkp
through 2.3.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1468
pkp.sfu.ca
http://pkp.sfu.ca/ojs/RELEASE-2.3.7
pkp.sfu.ca
http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431
Exploit
https://www.htbridge.com/advisory/HTB23079
More from Open Journal Systems
8.8
CVE-2023-5626
Cross-Site Request Forgery (CSRF) in pkp/ojs
6.1
CVE-2024-24511
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component
6.1
CVE-2024-25438
A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into…
6.1
CVE-2024-24512
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component
3.8
CVE-2026-111609
PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription