Listen to this Post
The vulnerability targets OpenClinica Community Edition versions up to 3.12.2 and 3.13. It resides in the CRF Data Import component, specifically the `/ImportCRFData?action=confirm` endpoint. This endpoint processes XML files for importing Case Report Form data. The `xml_file` parameter is inadequately validated, allowing attackers to inject malicious XML content remotely via HTTP requests. XML injection manipulates the XML structure by inserting arbitrary elements or entities. This can corrupt data, cause denial of service, or potentially lead to remote code execution if the XML parser is misconfigured. Attackers exploit this by crafting XML payloads that, when processed, alter the intended XML parsing logic. For instance, injecting XML External Entities (XXE) could enable file reading or server-side request forgery. The attack requires low-privilege access (PR:L) but has limited impact on confidentiality (VC:L), with no direct impact on integrity or availability per CVSS. However, in practice, XML injection can escalate to more severe issues. The vulnerability stems from failing to sanitize user-supplied XML input before parsing. The public disclosure of the exploit increases attack likelihood. No patch is available as the vendor did not respond. Administrators should monitor import logs for anomalous activities.
Platform: OpenClinica Community Edition
Version: Up to 3.12.2
Vulnerability: XML Injection
Severity: Medium
Date: 11/09/2025
Prediction: Patch date unknown
What Undercode Say:
Analytics:
curl -X POST -F “[email protected]” http://target/OpenClinica/ImportCRFData?action=confirm
cat malicious.xml
]>&exploit;
nmap -sV –script http-xxe target.com
How Exploit:
Craft XML payload with external entities. Submit via xml_file parameter. Exploit file reading or DoS.
Protection from this CVE:
Disable XML external entities. Input validation and sanitization. Use web application firewall.
Impact:
Data corruption, information disclosure, potential remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
