Bug 14412 - SQL Injection in OPAC Interface
Summary: SQL Injection in OPAC Interface
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: PC Linux
: P1 - high critical (vote)
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
: 14410 (view as bug list)
Depends on:
Blocks: 13618
  Show dependency treegraph
 
Reported: 2015-06-18 15:23 UTC by Raschin Tavakoli
Modified: 2016-12-05 21:22 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 14412 : SQL injection possible (1.73 KB, patch)
2015-06-18 20:37 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14412 : SQL injection possible (1.80 KB, patch)
2015-06-19 07:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
[PASSED QA] Bug 14412 : SQL injection possible (1.92 KB, patch)
2015-06-19 10:31 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Raschin Tavakoli 2015-06-18 15:23:54 UTC
There is a SQL Injection vulnerability in the /cgi-bin/koha/opac-tags_subject.pl script. 

By manipulating the variable 'number', the database can be accessed via time-based blind injections. 

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed
Comment 1 Chris Cormack 2015-06-18 18:53:41 UTC
*** Bug 14410 has been marked as a duplicate of this bug. ***
Comment 2 Chris Cormack 2015-06-18 20:37:59 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2015-06-19 07:47:45 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-06-19 10:31:17 UTC
Created attachment 40359 [details] [review]
[PASSED QA] Bug 14412 : SQL injection possible

There is a SQL Injection vulnerability in the
/cgi-bin/koha/opac-tags_subject.pl script.

By manipulating the variable 'number', the database can be accessed
via time-based blind injections.

The following string serves as an example:

/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)

To exploit the vulnerability, no authentication is needed

To test
1/ Turn on mysql query logging
2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
3/ Check the logs notice something like
  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
  PROCEDURE ANALYSE
  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
4/ Apply patch
5/ Hit the url again
6/ Notice the log now only has
   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed the problem and the fix for it.
Comment 5 Liz Rea 2015-06-20 05:51:19 UTC
Applied to 3.18.x.
Comment 6 Tomás Cohen Arazi 2015-06-22 14:39:53 UTC
Patch pushed to master.

Thanks Chris!
Comment 7 Chris Cormack 2015-06-22 22:12:31 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 8 Liz Rea 2015-06-23 01:56:18 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 9 Fridolin SOMERS 2015-06-23 09:29:40 UTC
Pushed to 3.14.x, will be in 3.14.16
Comment 10 Mason James 2015-06-23 14:04:58 UTC
Pushed to 3.16.x, will be in 3.16.12