Bug 38829

Summary: [CVE-2025-22954] SQL Injection in lateissues-export.pl
Product: Koha Reporter: Zeyad Alshahrani <zeyadbinkhalid>
Component: SerialsAssignee: Jonathan Druart <jonathan.druart>
Status: RESOLVED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: critical    
Priority: P5 - low CC: dcook, didier.gautheron, fridolin.somers, jesse, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, paul.derscheid, philippe.blouin, tomascohen, wainuiwitikapark
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: Small patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
25.05.00,24.11.02,24.05.07,23.11.12,22.11.24
Circulation function:
Bug Depends on:    
Bug Blocks: 39915    
Attachments: Bug 38829: Add a test
Bug 38829: Sanitize GetLateOrMissingIssues inputs
Bug 38829: Add a test
Bug 38829: Sanitize GetLateOrMissingIssues inputs
Bug 38829: Add a test
Bug 38829: Sanitize GetLateOrMissingIssues inputs
Bug 38829: Sanitize GetLateOrMissingIssues inputs

Description Zeyad Alshahrani 2025-01-06 10:29:09 UTC
Dears,

An SQL Injection was found in lateissues-export.pl that allows unauthenticated users (version <= 21.11.x) or authenticated users (version > 21.11.x) to inject arbitrary SQL instructions.

The vulnerable function is GetLateOrMissingIssues (C4/Serials.pm) which allows injecting SQL instructions directly without any type of sanitization using the supplierid and/or serialid.

Best regards.
Comment 1 Zeyad Alshahrani 2025-01-06 10:30:11 UTC
P.S: I requested a CVE 2 days ago.

Best regards.
Comment 2 Martin Renvoize (ashimema) 2025-01-06 10:54:36 UTC
Moving to Koha Security
Comment 3 Jonathan Druart 2025-01-06 13:26:56 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2025-01-06 13:27:00 UTC Comment hidden (obsolete)
Comment 5 Katrin Fischer 2025-01-07 08:39:06 UTC
Thanks for the quick work so far!
Comment 6 Magnus Enger 2025-01-07 10:30:31 UTC
Created attachment 176171 [details] [review]
Bug 38829: Add a test

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Comment 7 Magnus Enger 2025-01-07 10:30:35 UTC
Created attachment 176172 [details] [review]
Bug 38829: Sanitize GetLateOrMissingIssues inputs

Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.
Comment 8 Marcel de Rooy 2025-01-10 09:04:33 UTC
Second patch changed author?
Comment 9 Marcel de Rooy 2025-01-10 09:06:41 UTC
Created attachment 176312 [details] [review]
Bug 38829: Add a test

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Added a shebang line.
Comment 10 Marcel de Rooy 2025-01-10 09:06:44 UTC
Created attachment 176313 [details] [review]
Bug 38829: Sanitize GetLateOrMissingIssues inputs

Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 11 Jonathan Druart 2025-01-10 15:10:56 UTC
(In reply to Marcel de Rooy from comment #8)
> Second patch changed author?

Will restore on Monday.
Comment 12 Jonathan Druart 2025-01-13 08:24:33 UTC
Created attachment 176426 [details] [review]
Bug 38829: Sanitize GetLateOrMissingIssues inputs

Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 13 Zeyad Alshahrani 2025-01-23 19:09:53 UTC
Dears,

The CVE number is: CVE-2025-22954

Kind regards.
Comment 14 Katrin Fischer 2025-01-27 15:25:19 UTC
This is scheduled to be in the next maintenance releases.
Comment 15 Wainui Witika-Park 2025-02-03 23:24:26 UTC
Applied to 24.05.x-security
Comment 16 Fridolin Somers 2025-02-14 14:08:16 UTC
Applied to 23.11.x-security
Comment 17 Jesse Maseto 2025-02-19 16:09:14 UTC
Applied to 22.11.x-security branch for next release.
Comment 18 Paul Derscheid 2025-02-22 18:20:28 UTC
Applied to 24.11.x-security
Comment 19 Jesse Maseto 2025-02-24 16:27:58 UTC
Please rebase for 22.11.x
Comment 20 Katrin Fischer 2025-02-24 18:55:18 UTC
(In reply to Jesse Maseto from comment #17)
> Applied to 22.11.x-security branch for next release.

(In reply to Jesse Maseto from comment #19)
> Please rebase for 22.11.x

?
Comment 21 Katrin Fischer 2025-02-24 19:04:06 UTC
(In reply to Katrin Fischer from comment #20)
> (In reply to Jesse Maseto from comment #17)
> > Applied to 22.11.x-security branch for next release.
> 
> (In reply to Jesse Maseto from comment #19)
> > Please rebase for 22.11.x
> 
> ?

It's already in 22.11-security -> ec77a84c1ce8ca58214587291d16387b2ffce109
Comment 22 Katrin Fischer 2025-03-06 13:00:24 UTC
Pushed for 25.05!

Well done everyone, thank you!