https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829
Bug ID: 38829
Summary: SQL Injection in lateissues-export.pl
Change sponsored?: ---
Product: Koha
Version: unspecified
Hardware: All
OS: All
Status: NEW
Severity: critical
Priority: P5 - low
Component: Serials
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Dears,
An SQL Injection was found in lateissues-export.pl that allows unauthenticated
users (version <= 21.11.x) or authenticated users (version > 21.11.x) to inject
arbitrary SQL instructions.
The vulnerable function is GetLateOrMissingIssues (C4/Serials.pm) which allows
injecting SQL instructions directly without any type of sanitization using the
supplierid and/or serialid.
Best regards.
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
[email protected]
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
