Critical · published February 24, 2025
🔥 A crafty XML upload can give Journal Editors the power to create super admins, turning a minor role into a critical threat! Think of it like a hotel receptionist who can suddenly access the master key for all rooms just by showing a fake ID — they can let themselves in anywhere, which leads to chaos! An attacker could potentially take control of the entire journal system, granting themselves super admin access, and even plant a backdoor plugin. This means they could manipulate publications, steal sensitive data, or sabotage the journal's integrity — absolutely devastating!
Think of it like a hotel receptionist who can suddenly access the master key for all rooms just by showing a fake ID — they can let themselves in anywhere, which leads to chaos! This XXE vulnerability allows Journal Editors in PKP OJS, OMP, and OPS (versions before 3.3.0.21 and 3.4.x prior to 3.4.0.8) to upload specially crafted XML documents that exploit the system and escalate privileges.
An attacker could potentially take control of the entire journal system, granting themselves super admin access, and even plant a backdoor plugin. This means they could manipulate publications, steal sensitive data, or sabotage the journal's integrity — absolutely devastating! Patch your systems immediately to version 3.3.0.21 or 3.4.0.8 to close this gap. Additionally, conduct an audit of user roles and prevent XML uploads from unauthorized sources to enhance security. You've got this! With the right steps, your journal can be safe and sound! 🛡️