Bug 11666 - admin/import_export_framework.pl allows execution of arbitrary SQL without authentication
Summary: admin/import_export_framework.pl allows execution of arbitrary SQL without au...
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P1 - high critical (vote)
Assignee: Galen Charlton
QA Contact: Testopia
Depends on:
Reported: 2014-02-03 00:04 UTC by John Lightsey
Modified: 2019-06-27 09:24 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description John Lightsey 2014-02-03 00:04:41 UTC
This interface doesn't require authentication and allows SQL to be injected into the system. The limitation is that the SQL statements must match

$line =~ /^\s*(?i:DELETE\s+FROM|INSERT\s+INTO)\s+(?:marc_tag_structure|marc_subfield_structure)/


$line =~ /'$frameworkcode'/
Comment 1 Galen Charlton 2014-02-03 21:29:39 UTC
I've confirmed both parts of the bug.  I'm not sure that I see a way to get DML through, since we're not doing mysql_multi_statements, but INSERT INTO marc_subfield_structure ... SELECT FROM... would provide a way for an attacker to get the contents of arbitrary rows from any table in the Koha database.

Serious consideration should be given to simply dropping exporting and importing the frameworks as SQL -- we can find somebody to maintain CSV versions of the stock ones for the website.
Comment 3 Galen Charlton 2014-02-04 16:05:27 UTC
I've attached a patch that fixes the lacked of authentication.  Not setting the status to needs signoff yet because the second part of the bug is not yet tackled, but anybody should feel free to review the first patch.
Comment 12 Galen Charlton 2014-02-07 01:43:21 UTC
Pushed to master.
Comment 13 Galen Charlton 2014-02-07 02:05:57 UTC
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.