Bug 11666

Summary: admin/import_export_framework.pl allows execution of arbitrary SQL without authentication
Product: Koha Reporter: John Lightsey <john>
Component: Architecture, internals, and plumbingAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P1 - high CC: robin, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description John Lightsey 2014-02-03 00:04:41 UTC
This interface doesn't require authentication and allows SQL to be injected into the system. The limitation is that the SQL statements must match

$line =~ /^\s*(?i:DELETE\s+FROM|INSERT\s+INTO)\s+(?:marc_tag_structure|marc_subfield_structure)/

and

$line =~ /'$frameworkcode'/
Comment 1 Galen Charlton 2014-02-03 21:29:39 UTC
I've confirmed both parts of the bug.  I'm not sure that I see a way to get DML through, since we're not doing mysql_multi_statements, but INSERT INTO marc_subfield_structure ... SELECT FROM... would provide a way for an attacker to get the contents of arbitrary rows from any table in the Koha database.

Serious consideration should be given to simply dropping exporting and importing the frameworks as SQL -- we can find somebody to maintain CSV versions of the stock ones for the website.
Comment 3 Galen Charlton 2014-02-04 16:05:27 UTC
I've attached a patch that fixes the lacked of authentication.  Not setting the status to needs signoff yet because the second part of the bug is not yet tackled, but anybody should feel free to review the first patch.
Comment 12 Galen Charlton 2014-02-07 01:43:21 UTC
Pushed to master.
Comment 13 Galen Charlton 2014-02-07 02:05:57 UTC
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.