CVE-2024-36058

Name of the Vulnerable Software and Affected Versions Koha Library versions prior to 23.05.10

Description The Send Basket functionality is susceptible to Time-Based SQL Injection, a technique where an attacker sends a query that forces the database to wait for a specific amount of time before responding, allowing them to infer data. This occurs because the application fails to sanitize the bib list POST parameter in the '/cgi-bin/koha/opac-sendbasket.pl' endpoint, which enables library users to read arbitrary data from the database.

Recommendations Update to version 23.05.10 or later. As a temporary mitigation, restrict access to the '/cgi-bin/koha/opac-sendbasket.pl' endpoint or avoid using the bib list parameter.