An exploit has been published against LibLime Koha <= 4.2 on http://1337day.com/exploits/17246 . After quick verification, koha 3.6.x is vulnerable (other version should be too). As the exploit is public, this bug report is too. Thanks.
*** This bug has been marked as a duplicate of bug 6629 ***