Bug 14412

Summary: SQL Injection in OPAC Interface
Product: Koha Reporter: Raschin Tavakoli <RGhanad-Tavakoli>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P1 - high CC: dsimos, fridolin.somers, jonathan.druart, katrin.fischer, liz, mtj, robin, tomascohen
Version: Main   
Hardware: PC   
OS: Linux   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 13618    
Attachments: Bug 14412 : SQL injection possible
Bug 14412 : SQL injection possible
[PASSED QA] Bug 14412 : SQL injection possible

Description Raschin Tavakoli 2015-06-18 15:23:54 UTC
There is a SQL Injection vulnerability in the /cgi-bin/koha/opac-tags_subject.pl script. 

By manipulating the variable 'number', the database can be accessed via time-based blind injections. 

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed
Comment 1 Chris Cormack 2015-06-18 18:53:41 UTC
*** Bug 14410 has been marked as a duplicate of this bug. ***
Comment 2 Chris Cormack 2015-06-18 20:37:59 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2015-06-19 07:47:45 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-06-19 10:31:17 UTC
Created attachment 40359 [details] [review]
[PASSED QA] Bug 14412 : SQL injection possible

There is a SQL Injection vulnerability in the
/cgi-bin/koha/opac-tags_subject.pl script.

By manipulating the variable 'number', the database can be accessed
via time-based blind injections.

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed

To test
1/ Turn on mysql query logging
2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
3/ Check the logs notice something like
  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
  PROCEDURE ANALYSE
  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
4/ Apply patch
5/ Hit the url again
6/ Notice the log now only has
   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed the problem and the fix for it.
Comment 5 Liz Rea 2015-06-20 05:51:19 UTC
Applied to 3.18.x.
Comment 6 Tomás Cohen Arazi 2015-06-22 14:39:53 UTC
Patch pushed to master.

Thanks Chris!
Comment 7 Chris Cormack 2015-06-22 22:12:31 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 8 Liz Rea 2015-06-23 01:56:18 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 9 Fridolin Somers 2015-06-23 09:29:40 UTC
Pushed to 3.14.x, will be in 3.14.16
Comment 10 Mason James 2015-06-23 14:04:58 UTC
Pushed to 3.16.x, will be in 3.16.12