Summary: | admin/import_export_framework.pl allows execution of arbitrary SQL without authentication | ||
---|---|---|---|
Product: | Koha | Reporter: | John Lightsey <john> |
Component: | Architecture, internals, and plumbing | Assignee: | Galen Charlton <gmcharlt> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P1 - high | CC: | robin, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: |
Description
John Lightsey
2014-02-03 00:04:41 UTC
I've confirmed both parts of the bug. I'm not sure that I see a way to get DML through, since we're not doing mysql_multi_statements, but INSERT INTO marc_subfield_structure ... SELECT FROM... would provide a way for an attacker to get the contents of arbitrary rows from any table in the Koha database. Serious consideration should be given to simply dropping exporting and importing the frameworks as SQL -- we can find somebody to maintain CSV versions of the stock ones for the website. I've attached a patch that fixes the lacked of authentication. Not setting the status to needs signoff yet because the second part of the bug is not yet tackled, but anybody should feel free to review the first patch. Pushed to master. Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3. |