CVE-2015-10091 (published 2023-03-06T04:15Z)

A vulnerability has been found in ByWater Solutions bywater-koha-xslt and classified as critical. This vulnerability affects the function StringSearch of the file admin/systempreferences.pl. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 9513b93c828dfbc4413f9e0df63647401aaf4e58. It is recommended to apply a patch to fix this issue. VDB-222322 is the identifier assigned to this vulnerability.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/bywatersolutions/bywater-koha-xslt
commit_details: repo_url: https://github.com/bywatersolutions/bywater-koha-xslt
author: David Cook
author_date: 2015-07-13 14:06:46+10:00
msg: Bug 14521: SQL injection in local use system preferences

This patch fixes a SQL injection vulnerability in the local use
system preferences.

_TEST PLAN_

Before applying:

1) Go to Global System Preferences
2) Click on the "Local use" tab
3) Add a new preference with the value "') or '1' = '1' -- "
(be sure to include the space at the end after the comment --).
4) When the page refreshes, you should now see about 99 other system
preferences which shouldn't be showing up.

5) Apply the patch

6) Refresh the page
7) Note that you now only see a system preference for "') or '1' = '1' -- "
and the other actual local use system preferences.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit a72262a950aa701cebe460e2a3a7586edecd86be)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
repository: repo_url: https://github.com/bywatersolutions/bywater-koha-xslt
repo_name: bywatersolutions/bywater-koha-xslt
description: Koha repository with XSLT customizations for ByWater partners
repo_language: Perl
owner: bywatersolutions
file_changes: filename: systempreferences.pl
change_type: ModificationType.MODIFY
diff: @@ -70,14 +70,16 @@ sub StringSearch {
 
     my $strsth = "Select variable,value,explanation,type,options from systempreferences where variable in (";
     my $first = 1;
+    my @sql_bind;
     for my $name ( get_local_prefs() ) {
                 $strsth .= ',' unless $first;
-                $strsth .= "'$name'";
+                $strsth .= "?";
+                push(@sql_bind,$name);
                 $first = 0;
     }
     $strsth .= ") order by variable";
     $sth = $dbh->prepare($strsth);
-    $sth->execute();
+    $sth->execute(@sql_bind);
 
     while ( my $data = $sth->fetchrow_hashref ) {
             unless (defined $data->{value}) { $data->{value} = "";}

programming_language: Perl