CVE-2012-1468
Summary
| CVE | CVE-2012-1468 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-09-06 21:55:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions. |
Risk And Classification
Primary CVSS: v2.0 6 from [email protected]
AV:N/AC:M/Au:S/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:S/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Pkp | Open Journal Systems | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| OJS 2.3.7 Released - PKP Support | af854a3a-2127-422b-91ae-364da2661108 | pkp.sfu.ca | |
| pkp.sfu.ca/ojs/RELEASE-2.3.7 | af854a3a-2127-422b-91ae-364da2661108 | pkp.sfu.ca | |
| File Not Found | af854a3a-2127-422b-91ae-364da2661108 | www.htbridge.com | Exploit |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.