Description
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PKP Open Journal Systems
Default version status: unaffected
0 to ≤ 3.5.0-5affected
pkg:github/pkp/ojsReferences
- https://hackmd.io/@hieuPenguinnn/ojs-subscription-form-cross-journal-idor ↗
- https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/IndividualSubscriptionForm.php#L47-L51 ↗
- https://github.com/pkp/ojs/blob/3_5_0-5/controllers/grid/subscriptions/InstitutionalSubscriptionForm.php#L57-L62 ↗
- https://www.vulncheck.com/advisories/pkp-open-journal-systems-through-3.5.0-5-cross-journal-subscription-idor-via-updatesubscription ↗