Koha
CVE-2024-28739
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.
AnalysisAI
An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. Affected products include: Koha.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via t
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Fo
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management S
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting
Koha versions 25.11 and earlier contain a stored cross-site scripting vulnerability in the News function that allows aut
A vulnerability was found in KOHA up to 23.05.03. Rated medium severity (CVSS 5.4), this vulnerability is remotely explo
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holdin
Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.
Authenticated remote code execution in Koha lets anyone who can reach the affected web service on TCP port 8081 feed a c
SQL injection in the Koha library management system's staff interface allows authenticated users to manipulate the displ
Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 a
Stored SQL injection in Koha library management software allows authenticated staff holding the items_batchmod permissio
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today