External risk intelligence

Koha Library Time-Based SQL Injection Allows Database Data Reading.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-36058

The vulnerability exists in the OPAC (Online Public Access Catalog) component of the Koha Library software, which is a web interface specifically designed to be public-facing for library users to search catalogs and manage lists. Because this functionality is intended for open internet access by the public, it is commonly exposed.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the Koha Library software's "Send Basket" feature, which could allow unauthorized users to access sensitive library data. The issue stems from inadequate security in how user-provided information is handled, potentially exposing database contents to anyone interacting with this specific function. While the full impact requires further assessment, the nature of this flaw warrants attention to confirm its relevance to our environment.

Sensitive data accessible via library software.
Public-facing feature allows broad exposure risk.
Confirm relevance and library system exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending specially crafted requests to the library's public catalog interface. By exploiting a flaw in how user-provided data is handled when managing item lists, an attacker can manipulate database queries. This manipulation could allow them to access sensitive information stored within the library's database.

Publicly accessible catalog interface.
Insecure handling of item list parameters.
Unauthorized access to sensitive database data.

Live Threat

Current exploitation, exposure, and threat context

Library users could read arbitrary data from the Koha Library database when the Send Basket functionality is used, given that the application fails to sanitize the POST parameter bib_list. This could allow an attacker to exfiltrate sensitive information stored within the library's database.

Sensitive library data.
Unsanitized input via Send Basket.
Unauthorized access to patron data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to the library's IT or systems administration team responsible for the Koha Library application and its underlying infrastructure. Initially, focus on identifying all instances of the affected Koha Library application, assessing their external reachability and criticality to library operations, and confirming the designated owner for each instance. Subsequently, a remediation plan should be developed based on the identified risks and operational impact.

Library IT team owns the issue.
Verify external reachability and criticality.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Koha Library software?

Koha is an open-source integrated library system used worldwide by libraries to manage their collections. It includes an Online Public Access Catalog (OPAC) that serves as the public-facing web interface where patrons search for books, view availability, and manage personal lists, such as the "Send Basket" feature used to email selected items.

What does SQL injection mean for CVE-2024-36058?

This vulnerability is a Time-Based SQL Injection, categorized as CWE-89. It means the software does not properly filter user input before using it in a database query. Because it is 'time-based,' an attacker can ask the database true-or-false questions and observe how long the system takes to respond, allowing them to slowly reconstruct and extract sensitive information stored in the database.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by submitting a specially crafted POST request containing malicious data to the 'bib_list' parameter in the 'opac-sendbasket.pl' script. It is important to note that simply visiting the public catalog or browsing items normally does not trigger this issue; the exploit requires specific, intentional manipulation of the Send Basket submission process.

Is my library system at risk from this CVE?

Halo Surface Signal indicates that because the affected 'Send Basket' feature is part of the public-facing OPAC interface, it is inherently designed to be accessible via the internet. If your Koha instance is reachable online for public use, it is considered exposed to this vulnerability and should be prioritized for investigation.

What steps should I take to address this issue?

First, locate all running instances of Koha Library within your environment to understand your total footprint. Once identified, verify which systems are internet-facing and determine the administrative owner for each. Finally, consult the official Koha release notes for version 23.05.10 or later to identify and apply the necessary software updates to secure the Send Basket functionality.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.