CVE-2024-36057: Command Injection
Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -d $dirname/;" in upload-cover-image.pl is vulnerable to command injection via shell metacharacters because input data can be controlled by an attacker and is directly included in a system command, i.e., an attack can occur via malicious filenames after uploading a .zip file and clicking Process Images.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36057?
CVE-2024-36057 is categorized as a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-36057?
To mitigate CVE-2024-36057, upgrade Koha Library to version 23.05.10 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2024-36057?
CVE-2024-36057 is a command injection vulnerability that arises from improper sanitization of user-controllable filenames.
Which versions of Koha Library are affected by CVE-2024-36057?
Koha Library versions prior to 23.05.10 are affected by CVE-2024-36057.
Can CVE-2024-36057 lead to data breaches?
Yes, CVE-2024-36057 can lead to data breaches since it allows for remote code execution, potentially compromising sensitive data.