SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
| Link | Tags |
|---|---|
| http://koha-community.org/security-release-february-2014/ | vendor advisory |
| http://www.openwall.com/lists/oss-security/2014/02/07/10 | third party advisory mailing list |
| http://www.openwall.com/lists/oss-security/2014/02/10/3 | third party advisory mailing list |
| http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666 | issue tracking exploit vendor advisory |