CVE-2025-22954

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22954
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829
https://koha-community.org/koha-24-11-02-released/
Configurations

No configuration.

History

18 Mar 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) GetLateOrMissingIssues en C4/Serials.pm en Koha antes del 24.11.02 permite la inyección de SQL en /serials/lateissues-export.pl a través del parámetro supplyid o serialid.

13 Mar 2025, 04:15

Type Values Removed Values Added
Summary (en) Koha <= 21.11 is contains a SQL Injection vulnerability in /serials/lateissues-export.pl via the supplierid parameter. (en) GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.
CVSS v2 : unknown
v3 : 5.0 		v2 : unknown
v3 : 10.0
References
  • () https://koha-community.org/koha-24-11-02-released/ -

12 Mar 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.0
CWE CWE-89

12 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-12 15:15

Updated : 2025-03-18 14:15

NVD link : CVE-2025-22954

Mitre link : CVE-2025-22954

CVE.ORG link : CVE-2025-22954

JSON object : View

Products Affected

No product.

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')