CVE-2015-4633

published 2018-10-18

CVE-2015-4633: Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote…

Priority P2 68 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
koha	koha	>= 3.14.00 < 3.14.16	3.14.16
koha	koha	>= 3.16.00 < 3.16.12	3.16.12
koha	koha	>= 3.18.00 < 3.18.08	3.18.08
koha	koha	>= 3.20.00 < 3.20.01	3.20.01
koha_community	koha	< 22.11.38	22.11.38
koha_community	koha	23.05.00 – 23.11.15	—
koha_community	koha	>= 24.05.00 < 24.11.16	24.11.16
koha_community	koha	>= 25.05.00 < 25.05.11	25.05.11
koha_community	koha	>= 25.11.00 < 25.11.05	25.11.05
koha_community	koha	>= 26.05.00 < 26.05.01	26.05.01

Detection & IOCs extracted from sources · hover to see the quote

url /cgi-bin/koha/opac-tags_subject.pl?number=10↗

path /cgi-bin/koha/opac-tags_subject.pl↗

path /cgi-bin/koha/reports/borrowers_out.pl↗

command number=1 PROCEDURE ANALYSE(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(4000000,MD5(0x4b754a4b))))),1)↗

command Criteria=ELT(1=1,'evil')↗

command Criteria=ELT(1=2,'evil')↗

port 9001↗

port 9002↗

• → Monitor GET requests to opac-tags_subject.pl where the 'number' parameter contains SQL keywords or time-based blind injection patterns such as PROCEDURE ANALYSE, BENCHMARK, or EXTRACTVALUE. ↗
• → Monitor POST requests to reports/borrowers_out.pl for SQL injection payloads in the 'Filter' or 'Criteria' parameters, specifically ELT() boolean-based injection patterns. ↗
• → The OPAC-side injection in opac-tags_subject.pl requires no authentication; alert on any anomalous or non-numeric value in the 'number' GET parameter from unauthenticated sessions. ↗
• → Detect time-based blind SQLi exploitation attempts by monitoring for unusually high response latency on requests to opac-tags_subject.pl, consistent with BENCHMARK() delays. ↗
• → The Staff interface borrowers_out.pl exploitation uses raw TCP (nc) with crafted HTTP POST; monitor for raw TCP connections to the Koha staff port carrying POST requests with SQL-laden Criteria parameters. ↗

• · The time-based blind injection technique requires sqlmap's --time-sec tuning; network latency can cause false negatives or errors during exploitation, as evidenced by repeated time-delay increases during the PoC. ↗
• · Filesystem read/write access via SQL injection is only possible if the MySQL server is misconfigured (e.g., FILE privilege granted or secure_file_priv not set). ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89