CVE-2015-4633

Sažetak

Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.

Reference

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14412
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426
https://koha-community.org/koha-3-14-16-released/
https://koha-community.org/security-release-koha-3-16-12/
https://koha-community.org/security-release-koha-3-18-8/
https://koha-community.org/security-release-koha-3-20-1/
https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html
https://seclists.org/fulldisclosure/2015/Jun/80
https://www.exploit-db.com/exploits/37387/
https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/

CVSS

Base:	7.5
Impact:	6.4
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	PARTIAL	PARTIAL

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:P/A:P

Zadnje važnije ažuriranje

06-12-2018 - 14:26

Objavljeno

18-10-2018 - 21:29