Bug 11666 - admin/import_export_framework.pl allows execution of arbitrary SQL without authentication
Summary: admin/import_export_framework.pl allows execution of arbitrary SQL without au...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P1 - high critical
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-03 00:04 UTC by John Lightsey
Modified: 2019-06-27 09:24 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Lightsey 2014-02-03 00:04:41 UTC 
This interface doesn't require authentication and allows SQL to be injected into the system. The limitation is that the SQL statements must match

$line =~ /^\s*(?i:DELETE\s+FROM|INSERT\s+INTO)\s+(?:marc_tag_structure|marc_subfield_structure)/

and

$line =~ /'$frameworkcode'/
Comment 1 Galen Charlton 2014-02-03 21:29:39 UTC 
I've confirmed both parts of the bug.  I'm not sure that I see a way to get DML through, since we're not doing mysql_multi_statements, but INSERT INTO marc_subfield_structure ... SELECT FROM... would provide a way for an attacker to get the contents of arbitrary rows from any table in the Koha database.

Serious consideration should be given to simply dropping exporting and importing the frameworks as SQL -- we can find somebody to maintain CSV versions of the stock ones for the website.
Comment 3 Galen Charlton 2014-02-04 16:05:27 UTC 
I've attached a patch that fixes the lacked of authentication.  Not setting the status to needs signoff yet because the second part of the bug is not yet tackled, but anybody should feel free to review the first patch.
Comment 12 Galen Charlton 2014-02-07 01:43:21 UTC 
Pushed to master.
Comment 13 Galen Charlton 2014-02-07 02:05:57 UTC 
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.