Dears, An SQL Injection was found in lateissues-export.pl that allows unauthenticated users (version <= 21.11.x) or authenticated users (version > 21.11.x) to inject arbitrary SQL instructions. The vulnerable function is GetLateOrMissingIssues (C4/Serials.pm) which allows injecting SQL instructions directly without any type of sanitization using the supplierid and/or serialid. Best regards.
P.S: I requested a CVE 2 days ago. Best regards.
Moving to Koha Security
Created attachment 176149 [details] [review] Bug 38829: Add a test
Created attachment 176150 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs
Thanks for the quick work so far!
Created attachment 176171 [details] [review] Bug 38829: Add a test Signed-off-by: Magnus Enger <magnus@libriotech.no>
Created attachment 176172 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied.
Second patch changed author?
Created attachment 176312 [details] [review] Bug 38829: Add a test Signed-off-by: Magnus Enger <magnus@libriotech.no> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [EDIT] Added a shebang line.
Created attachment 176313 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(In reply to Marcel de Rooy from comment #8) > Second patch changed author? Will restore on Monday.
Created attachment 176426 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Dears, The CVE number is: CVE-2025-22954 Kind regards.
This is scheduled to be in the next maintenance releases.
Applied to 24.05.x-security
Applied to 23.11.x-security
Applied to 22.11.x-security branch for next release.
Applied to 24.11.x-security
Please rebase for 22.11.x
(In reply to Jesse Maseto from comment #17) > Applied to 22.11.x-security branch for next release. (In reply to Jesse Maseto from comment #19) > Please rebase for 22.11.x ?
(In reply to Katrin Fischer from comment #20) > (In reply to Jesse Maseto from comment #17) > > Applied to 22.11.x-security branch for next release. > > (In reply to Jesse Maseto from comment #19) > > Please rebase for 22.11.x > > ? It's already in 22.11-security -> ec77a84c1ce8ca58214587291d16387b2ffce109
Pushed for 25.05! Well done everyone, thank you!