[Bug 38829] New: SQL Injection in lateissues-export.pl
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 Bug ID: 38829 Summary: SQL Injection in lateissues-export.pl Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Serials Assignee: koha-bugs@lists.koha-community.org Reporter: zeyadbinkhalid@gmail.com QA Contact: testopia@bugs.koha-community.org Dears, An SQL Injection was found in lateissues-export.pl that allows unauthenticated users (version <= 21.11.x) or authenticated users (version > 21.11.x) to inject arbitrary SQL instructions. The vulnerable function is GetLateOrMissingIssues (C4/Serials.pm) which allows injecting SQL instructions directly without any type of sanitization using the supplierid and/or serialid. Best regards. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 --- Comment #1 from zeyadbinkhalid@gmail.com --- P.S: I requested a CVE 2 days ago. Best regards. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |Main Group|Koha security | Component|Koha |Serials Version(s)| |25.05.00,24.11.02,24.05.07, released in| |23.11.12,22.11.24 Product|Koha security |Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)|25.05.00,24.11.02,24.05.07, |25.05.00,25.05.00,24.11.02, released in|23.11.12,22.11.24 |24.05.07,23.11.12,22.11.24 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 --- Comment #22 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |39915 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39915 [Bug 39915] Late issues export exports empty rows -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 Abdivasiyev Sunnatillo <abdivasiyevsunnatillo2008@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abdivasiyevsunnatillo2008@g | |mail.com -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org