14412 – SQL Injection in OPAC Interface

Bug 14412 - SQL Injection in OPAC Interface

Summary: SQL Injection in OPAC Interface

Status:	CLOSED FIXED

Alias:	None

Product:	Koha
Classification:	Unclassified
Component:	OPAC (show other bugs)
Version:	Main
Hardware:	PC Linux

Importance:	P1 - high critical
Assignee:	Owen Leonard
QA Contact:	Testopia

URL:
Keywords:

Duplicates (1):	14410 (view as bug list)
Depends on:
Blocks:	13618
	Show dependency tree / graph

Reported:	2015-06-18 15:23 UTC by Raschin Tavakoli
Modified:	2019-06-27 09:24 UTC (History)
CC List:	7 users (show)

See Also:
Change sponsored?:	---
Patch complexity:	Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 14412 : SQL injection possible (1.73 KB, patch) 2015-06-18 20:37 UTC, Chris Cormack	Details \| Diff \| Splinter Review
Bug 14412 : SQL injection possible (1.80 KB, patch) 2015-06-19 07:47 UTC, Jonathan Druart	Details \| Diff \| Splinter Review
[PASSED QA] Bug 14412 : SQL injection possible (1.92 KB, patch) 2015-06-19 10:31 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Raschin Tavakoli 2015-06-18 15:23:54 UTC

There is a SQL Injection vulnerability in the /cgi-bin/koha/opac-tags_subject.pl script. 

By manipulating the variable 'number', the database can be accessed via time-based blind injections. 

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed

Comment 1 Chris Cormack 2015-06-18 18:53:41 UTC

*** Bug 14410 has been marked as a duplicate of this bug. ***

Comment 2 Chris Cormack 2015-06-18 20:37:59 UTC Comment hidden (obsolete)

Created attachment 40334 [details] [review]
Bug 14412 : SQL injection possible

There is a SQL Injection vulnerability in the
/cgi-bin/koha/opac-tags_subject.pl script.

By manipulating the variable 'number', the database can be accessed
via time-based blind injections.

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed

To test
1/ Turn on mysql query logging
2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
3/ Check the logs notice something like
  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
  PROCEDURE ANALYSE
  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
4/ Apply patch
5/ Hit the url again
6/ Notice the log now only has
   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1

Comment 3 Jonathan Druart 2015-06-19 07:47:45 UTC Comment hidden (obsolete)

Created attachment 40346 [details] [review]
Bug 14412 : SQL injection possible

There is a SQL Injection vulnerability in the
/cgi-bin/koha/opac-tags_subject.pl script.

By manipulating the variable 'number', the database can be accessed
via time-based blind injections.

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed

To test
1/ Turn on mysql query logging
2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
3/ Check the logs notice something like
  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
  PROCEDURE ANALYSE
  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
4/ Apply patch
5/ Hit the url again
6/ Notice the log now only has
   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Comment 4 Katrin Fischer 2015-06-19 10:31:17 UTC

Created attachment 40359 [details] [review]
[PASSED QA] Bug 14412 : SQL injection possible

There is a SQL Injection vulnerability in the
/cgi-bin/koha/opac-tags_subject.pl script.

By manipulating the variable 'number', the database can be accessed
via time-based blind injections.

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed

To test
1/ Turn on mysql query logging
2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
3/ Check the logs notice something like
  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
  PROCEDURE ANALYSE
  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
4/ Apply patch
5/ Hit the url again
6/ Notice the log now only has
   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed the problem and the fix for it.

Comment 5 Liz Rea 2015-06-20 05:51:19 UTC

Applied to 3.18.x.

Comment 6 Tomás Cohen Arazi (tcohen) 2015-06-22 14:39:53 UTC

Patch pushed to master.

Thanks Chris!

Comment 7 Chris Cormack 2015-06-22 22:12:31 UTC

Pushed to 3.20.x will be in 3.20.1

Comment 8 Liz Rea 2015-06-23 01:56:18 UTC

Pushed to 3.18.x will be in 3.18.08

Comment 9 Fridolin Somers 2015-06-23 09:29:40 UTC

Pushed to 3.14.x, will be in 3.14.16

Comment 10 Mason James 2015-06-23 14:04:58 UTC

Pushed to 3.16.x, will be in 3.16.12