Koha SQL Injection

Koha versions prior to 24.11.02 suffer from a remote SQL injection vulnerability in C4/Serials.pm. Koha CVE-2025-22954: SQL Injection in lateissues-export.pl Overview This repository contains a proof of concept for CVE-2025-22954, a critical severity CVSS 10.0 SQL injection vulnerability in Koha...

CVE-2025-22954

creationtimestamp| type| source ---|---|--- 2025-03-13 03:44:00+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7392 2025-03-13 05:48:24+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114153547594880534 2025-03-17 07:43:58+00:00| seen|...

CVE-2025-22954

GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...

CVE-2025-22954

Koha vulnerability CVE-2025-22954 affects Koha before 24.11.02. The issue is in GetLateOrMissingIssues within C4/Serials.pm, triggered by the lateissues-export.pl script via supplierid or serialid parameters, enabling SQL injection. The exploitation path is documented in PoC materials (e.g., a Gi...