Bug 38829 - [CVE-2025-22954] SQL Injection in lateissues-export.pl
Summary: [CVE-2025-22954] SQL Injection in lateissues-export.pl
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks: 39915
  Show dependency treegraph
 
Reported: 2025-01-06 10:29 UTC by Zeyad Alshahrani
Modified: 2025-05-16 09:59 UTC (History)
16 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00,24.11.02,24.05.07,23.11.12,22.11.24
Circulation function:


Attachments
Bug 38829: Add a test (1.32 KB, patch)
2025-01-06 13:26 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 38829: Sanitize GetLateOrMissingIssues inputs (759 bytes, patch)
2025-01-06 13:27 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 38829: Add a test (1.37 KB, patch)
2025-01-07 10:30 UTC, Magnus Enger
Details | Diff | Splinter Review
Bug 38829: Sanitize GetLateOrMissingIssues inputs (856 bytes, patch)
2025-01-07 10:30 UTC, Magnus Enger
Details | Diff | Splinter Review
Bug 38829: Add a test (1.51 KB, patch)
2025-01-10 09:06 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 38829: Sanitize GetLateOrMissingIssues inputs (954 bytes, patch)
2025-01-10 09:06 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 38829: Sanitize GetLateOrMissingIssues inputs (938 bytes, patch)
2025-01-13 08:24 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Zeyad Alshahrani 2025-01-06 10:29:09 UTC
Dears,

An SQL Injection was found in lateissues-export.pl that allows unauthenticated users (version <= 21.11.x) or authenticated users (version > 21.11.x) to inject arbitrary SQL instructions.

The vulnerable function is GetLateOrMissingIssues (C4/Serials.pm) which allows injecting SQL instructions directly without any type of sanitization using the supplierid and/or serialid.

Best regards.
Comment 1 Zeyad Alshahrani 2025-01-06 10:30:11 UTC
P.S: I requested a CVE 2 days ago.

Best regards.
Comment 2 Martin Renvoize (ashimema) 2025-01-06 10:54:36 UTC
Moving to Koha Security
Comment 3 Jonathan Druart 2025-01-06 13:26:56 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2025-01-06 13:27:00 UTC Comment hidden (obsolete)
Comment 5 Katrin Fischer 2025-01-07 08:39:06 UTC
Thanks for the quick work so far!
Comment 6 Magnus Enger 2025-01-07 10:30:31 UTC
Created attachment 176171 [details] [review]
Bug 38829: Add a test

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Comment 7 Magnus Enger 2025-01-07 10:30:35 UTC
Created attachment 176172 [details] [review]
Bug 38829: Sanitize GetLateOrMissingIssues inputs

Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.
Comment 8 Marcel de Rooy 2025-01-10 09:04:33 UTC
Second patch changed author?
Comment 9 Marcel de Rooy 2025-01-10 09:06:41 UTC
Created attachment 176312 [details] [review]
Bug 38829: Add a test

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Added a shebang line.
Comment 10 Marcel de Rooy 2025-01-10 09:06:44 UTC
Created attachment 176313 [details] [review]
Bug 38829: Sanitize GetLateOrMissingIssues inputs

Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 11 Jonathan Druart 2025-01-10 15:10:56 UTC
(In reply to Marcel de Rooy from comment #8)
> Second patch changed author?

Will restore on Monday.
Comment 12 Jonathan Druart 2025-01-13 08:24:33 UTC
Created attachment 176426 [details] [review]
Bug 38829: Sanitize GetLateOrMissingIssues inputs

Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 13 Zeyad Alshahrani 2025-01-23 19:09:53 UTC
Dears,

The CVE number is: CVE-2025-22954

Kind regards.
Comment 14 Katrin Fischer 2025-01-27 15:25:19 UTC
This is scheduled to be in the next maintenance releases.
Comment 15 Wainui Witika-Park 2025-02-03 23:24:26 UTC
Applied to 24.05.x-security
Comment 16 Fridolin Somers 2025-02-14 14:08:16 UTC
Applied to 23.11.x-security
Comment 17 Jesse Maseto 2025-02-19 16:09:14 UTC
Applied to 22.11.x-security branch for next release.
Comment 18 Paul Derscheid 2025-02-22 18:20:28 UTC
Applied to 24.11.x-security
Comment 19 Jesse Maseto 2025-02-24 16:27:58 UTC
Please rebase for 22.11.x
Comment 20 Katrin Fischer 2025-02-24 18:55:18 UTC
(In reply to Jesse Maseto from comment #17)
> Applied to 22.11.x-security branch for next release.

(In reply to Jesse Maseto from comment #19)
> Please rebase for 22.11.x

?
Comment 21 Katrin Fischer 2025-02-24 19:04:06 UTC
(In reply to Katrin Fischer from comment #20)
> (In reply to Jesse Maseto from comment #17)
> > Applied to 22.11.x-security branch for next release.
> 
> (In reply to Jesse Maseto from comment #19)
> > Please rebase for 22.11.x
> 
> ?

It's already in 22.11-security -> ec77a84c1ce8ca58214587291d16387b2ffce109
Comment 22 Katrin Fischer 2025-03-06 13:00:24 UTC
Pushed for 25.05!

Well done everyone, thank you!