Public Knowledge Project Open Monograph Press up to 3.1.1-1 searchResults.tpl catalog.noTitlesSearch cross site scripting

Summaryinfo

A vulnerability was found in Public Knowledge Project Open Monograph Press up to 3.1.1-1. It has been rated as problematic. This affects an unknown function of the file templates/frontend/pages/searchResults.tpl. Performing a manipulation of the argument catalog.noTitlesSearch as part of Parameter results in cross site scripting. This vulnerability is identified as CVE-2018-12588. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Public Knowledge Project Open Monograph Press up to 3.1.1-1 (Knowledge Base Software). This affects an unknown function of the file templates/frontend/pages/searchResults.tpl. The manipulation of the argument catalog.noTitlesSearch as part of a Parameter leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-1 before 3.1.1-2 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field).

The bug was discovered 06/18/2018. The weakness was released 06/19/2018 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2018-12588 since 06/19/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3.1.1-2 eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-119384. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Knowledge Base Software

Vendor

• Public Knowledge Project

Name

• Open Monograph Press

Version

• 3.1.1-1

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion