An authenticated SQL Injection vulnerability was identified in the Koha staff interface. A low-privileged staff user can inject arbitrary SQL queries via a vulnerable request parameter processed by the GetDistinctValues functionality. The injection occurs due to unsafe handling of user-supplied input when constructing SQL queries without sufficient sanitization or strict validation. Successful exploitation allows an authenticated attacker to fully compromise the backend database. /cgi-bin/koha/suggestion/suggestion.pl displayby vulnerebl parameter
Thanks for reporting the issue. In future, could you make sure to report it as a "Koha Security" bug rather than a "Koha" bug for security reasons? For more details please see https://git.koha-community.org/Koha-community/Koha/src/branch/main/SECURITY.md
Can you provide some more information about the steps to take to reproduce this bug? I think that I've found the vulnerability but it would save time if you already have steps/a payload that works.
yes , I can provide payloads for execute also I have video POC if it needs /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) result will be ~10.11.15-MariaDB-ubu2204 it's error based SQLI /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,(SELECT+SUBSTRING(p assword,1,30)+FROM+borrowers+WHERE+userid='koha'))) it will give password hash for user koha between 1,30 /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,(SELECT+SUBSTRING(p assword,31,30)+FROM+borrowers+WHERE+userid='koha'))) file C4/Search.pm 2308-2314 my $sth = $dbh->prepare( "select DISTINCT($column) as value, count(*) as cnt from $table " . ( $string ? " where $column like \"$string%\"" : "" ) . "group by value order by $column " ); GET /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,database())) we can full dump db
and can I request CVE ?
(In reply to shukrulloh70 from comment #4) > and can I request CVE ? Thanks for providing that payload information. We'd prefer if you waited until after we fixed the bug and released it to the supported versions.
okey, approximately how long will it take
(In reply to shukrulloh70 from comment #6) > okey, approximately how long will it take I'm planning to look at this immediately, so I should have a fix available shortly. I would expect that fix to be tested and approved fairly quickly, and then released in a couple of weeks (ie end of the month).
So let me request a CVE request then. I think it will also be relevant when the bug is fixed. ))
As noted above, the SQL generates 500 errors on the staff interface, so it wouldn't be easy for a user to leak information. But they a couple of things do come to mind. They could use time-based attacks to figure things like passwords out. Or they could do a DOS attack.
(In reply to shukrulloh70 from comment #8) > So let me request a CVE request then. I think it will also be relevant when > the bug is fixed. )) We prefer that the CVE is requested after the fix is distributed, so that people can immediately apply the fix when they learn about the vulnerability.
Okay, good luck fixing the vulnerability.
(In reply to David Cook from comment #9) > As noted above, the SQL generates 500 errors on the staff interface, so it > wouldn't be easy for a user to leak information. > > But they a couple of things do come to mind. They could use time-based > attacks to figure things like passwords out. Or they could do a DOS attack. attacker able to get all db information but its hard to exploit and need long time, I provide payload which demonstrate leak user password hash
Created attachment 191239 [details] [review] Bug 41593: Validate displayby parameter in suggestion.pl This change validates the displayby parameter in suggestion.pl in order to prevent SQL injection. Test plan: 0. Do not apply the patch 1. Log into the staff interface 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 3. Notice a 500 error is generated 4. In the error logs, the MySQL version number will appear 5. Apply the patch 6. koha-plack --restart kohadev 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 8. Notice that no error is generated 9. Try each of the "Organize by" options on the left nav bar 10. Note that none of them generate an error and that the option is retained after clicking "Go"
(In reply to shukrulloh70 from comment #12) > (In reply to David Cook from comment #9) > > As noted above, the SQL generates 500 errors on the staff interface, so it > > wouldn't be easy for a user to leak information. > > > > But they a couple of things do come to mind. They could use time-based > > attacks to figure things like passwords out. Or they could do a DOS attack. > > attacker able to get all db information but its hard to exploit and need > long time, I provide payload which demonstrate leak user password hash I saw that your payload could leak the user password hash in the error logs but not in the user interface.
Although exploitation is non-trivial due to 500 errors, this is still a valid SQL injection vulnerability. The issue allows error-based and time-based SQL injection, which can be used to extract sensitive information (including password hashes)
(In reply to shukrulloh70 from comment #15) > Although exploitation is non-trivial due to 500 errors, this is still a > valid SQL injection vulnerability. > > The issue allows error-based and time-based SQL injection, which can be used > to extract sensitive information (including password hashes) Yep, certainly a valid SQL injection vulnerability. More developers will come online in about 5-6 hours, so hopefully we'll get some progress then.
okey ;)
Created attachment 191249 [details] [review] Bug 41593: Validate displayby parameter in suggestion.pl This change validates the displayby parameter in suggestion.pl in order to prevent SQL injection. Test plan: 0. Do not apply the patch 1. Log into the staff interface 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 3. Notice a 500 error is generated 4. In the error logs, the MySQL version number will appear 5. Apply the patch 6. koha-plack --restart kohadev 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 8. Notice that no error is generated 9. Try each of the "Organize by" options on the left nav bar 10. Note that none of them generate an error and that the option is retained after clicking "Go" Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 191250 [details] [review] Bug 41593: Add a Cypress test Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
hello any updates ?
(In reply to shukrulloh70 from comment #20) > hello any updates ? With Koha patches there are a few rounds of reviews. This has passed the first round of reviews. We're waiting on a second round of reviews, and then the release manager/release maintainers will pick it up for their next releases. Thanks for your patience.
Created attachment 191576 [details] [review] Bug 41593: Validate displayby parameter in suggestion.pl This change validates the displayby parameter in suggestion.pl in order to prevent SQL injection. Test plan: 0. Do not apply the patch 1. Log into the staff interface 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 3. Notice a 500 error is generated 4. In the error logs, the MySQL version number will appear 5. Apply the patch 6. koha-plack --restart kohadev 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 8. Notice that no error is generated 9. Try each of the "Organize by" options on the left nav bar 10. Note that none of them generate an error and that the option is retained after clicking "Go" Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Created attachment 191577 [details] [review] Bug 41593: Add a Cypress test Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Created attachment 191578 [details] [review] Bug 41593: (QA follow-up) Move cypress test This patch moves the cypress test into the Acqusitions folder to help keep t/cypress/integration organized as we add more tests.
hello can I request CVE ?
(In reply to shukrulloh70 from comment #25) > hello can I request CVE ? We'd appreciate it if you could wait just a bit more. The patches have passed the review phases, and now they just need to be included in security releases, which I expect would be next week. Once again we appreciate your patience here.
This doesn't apply cleanly to 24.11.x branches and below. We'll need patches for all supported versions.
Created attachment 191696 [details] [review] [24.11] Bug 41593: Validate displayby parameter in suggestion.pl This change validates the displayby parameter in suggestion.pl in order to prevent SQL injection. Test plan: 0. Do not apply the patch 1. Log into the staff interface 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 3. Notice a 500 error is generated 4. In the error logs, the MySQL version number will appear 5. Apply the patch 6. koha-plack --restart kohadev 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 8. Notice that no error is generated 9. Try each of the "Organize by" options on the left nav bar 10. Note that none of them generate an error and that the option is retained after clicking "Go" Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
(In reply to Jonathan Druart from comment #28) > Created attachment 191696 [details] [review] [review] > [24.11] Bug 41593: Validate displayby parameter in suggestion.pl > > This change validates the displayby parameter in suggestion.pl > in order to prevent SQL injection. > > Test plan: > 0. Do not apply the patch > 1. Log into the staff interface > 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? > op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) > 3. Notice a 500 error is generated > 4. In the error logs, the MySQL version number will appear > > 5. Apply the patch > 6. koha-plack --restart kohadev > > 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? > op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) > 8. Notice that no error is generated > 9. Try each of the "Organize by" options on the left nav bar > 10. Note that none of them generate an error and that the option is > retained after clicking "Go" > > Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com> Also apply to 22.11. I couldn't test the cypress test however.
so any changes ?? ))
(In reply to shukrulloh70 from comment #30) > so any changes ?? )) I think that it's being released on Monday but I'm not 100% sure yet. Thanks again for your patience.
Next minor releases are planned for next Monday (Jan 26)
(In reply to Jonathan Druart from comment #29) > (In reply to Jonathan Druart from comment #28) > > Created attachment 191696 [details] [review] [review] [review] > > [24.11] Bug 41593: Validate displayby parameter in suggestion.pl > > > > This change validates the displayby parameter in suggestion.pl > > in order to prevent SQL injection. > > > > Test plan: > > 0. Do not apply the patch > > 1. Log into the staff interface > > 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? > > op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) > > 3. Notice a 500 error is generated > > 4. In the error logs, the MySQL version number will appear > > > > 5. Apply the patch > > 6. koha-plack --restart kohadev > > > > 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? > > op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) > > 8. Notice that no error is generated > > 9. Try each of the "Organize by" options on the left nav bar > > 10. Note that none of them generate an error and that the option is > > retained after clicking "Go" > > > > Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > > Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com> > > Also apply to 22.11. I couldn't test the cypress test however. Applied to 22.11.x-security for 22.11.34 I couldn't test the cypress test either so I didn't apply the 2 cypress test commits
(In reply to Jonathan Druart from comment #32) > Next minor releases are planned for next Monday (Jan 26) hello any updates for new release? because I need report for my job CVE if it possible could you do it today please
(In reply to shukrulloh70 from comment #34) > (In reply to Jonathan Druart from comment #32) > > Next minor releases are planned for next Monday (Jan 26) > > hello any updates for new release? because I need report for my job CVE if > it possible could you do it today please You will know when this bug report is made public and the release maintainers will add the "Version released in:" field for the respective versions. Until then it would be considered very poor practice to disclose this via CVE. The community is diligently working on a fix here. In the meantime, please exercise some patience.
(In reply to Jonathan Druart from comment #32) > Next minor releases are planned for next Monday (Jan 26)
(In reply to shukrulloh70 from comment #36) > (In reply to Jonathan Druart from comment #32) > > Next minor releases are planned for next Monday (Jan 26) Releases have been delayed. We will let you know once they are out and this report is made public.
Pushed to main for 26.05.00 Pushed to 25.11 for 25.11.01 Pushed to 24.11 for 24.11.12 Great work everyone!
(In reply to shukrulloh70 from comment #34) > (In reply to Jonathan Druart from comment #32) > > Next minor releases are planned for next Monday (Jan 26) > > hello any updates for new release? because I need report for my job CVE if > it possible could you do it today please This is now public. There is a very good blog post from the author of this patch set, I encourage you to read it and take some of David's advice: https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/
Also pushed to 25.05.07!
could you give some information how I should report cve please
(In reply to shukrulloh70 from comment #41) > could you give some information how I should report cve please When you're submitting your request, I think you should include the URL to this bug report, and it would be useful in the report to say that the bug is fixed in versions 26.05.00, 25.11.01, 25.05.07, and 24.11.12