Listen to this Post
CVE-2024-36058 represents a critical time-based blind SQL injection vulnerability residing within the Online Public Access Catalog (OPAC) component of Koha Library Software.
Specifically, the flaw impacts the “Send Basket” functionality handled by the `/cgi-bin/koha/opac-sendbasket.pl` script.
During the basket-sending workflow, user-supplied input submitted via the POST parameter named `bib_list` fails to undergo adequate sanitization, proper escaping, or parameterization before being concatenated directly into internal database queries.
Because this script handles record identifiers directly, an unauthenticated or low-privileged remote attacker can craft malicious inputs containing SQL syntax and time delay functions like SLEEP().
When the application evaluates these injected commands against the underlying backend database, it pauses execution for the specified duration.
By observing the response time variations of the HTTP server, an attacker can perform boolean or time-based inferential data extraction.
This allows malicious actors to systematically enumerate sensitive database contents, including patron records, administrative usernames, and password reset tokens.
With access to password reset tokens, attackers can hijack other user accounts and compromise the entire library catalog system.
The flaw bypasses standard input validation layers because the backend trusts the structured formatting of the bibliography list parameters during export tasks.
Exploitation requires network access to the OPAC interface without requiring complex multi-step user interaction beyond standard basket operations.
The vulnerability carries a CVSS v3.1 base score of 9.8, categorizing it as critical due to its potential for total confidentiality and integrity compromise.
Remediation requires upgrading the Koha Library installation to version 23.05.10 or later, or version 22.05.22, where input parameter sanitization is properly enforced.
DailyCVE Form:
Platform: Koha Library Software
Version: Below version 23.05.10
Vulnerability: Time-Based SQL Injection
Severity: Critical
date: April 7 2026
Prediction: Already patched 2026
What Undercode Say:
Analysis of the source code reveals that the `opac-sendbasket.pl` script fails to parse list parameters securely.
The `bib_list` variable receives input parameters directly from POST requests without binding values through database placeholders.
This design oversight allows direct manipulation of the query execution flow.
Security auditors can test endpoints using curl commands to verify latency responses:
curl -X POST "http://target-library/cgi-bin/koha/opac-sendbasket.pl" \ -d "bib_list=1); SELECT SLEEP(5);--"
Security teams should monitor web application firewalls for anomalous execution delays targeting OPAC export endpoints.
Exploit: (Educational Purposes!)
To test this vulnerability, an attacker intercepts the POST request sent when clicking the “Send Basket” feature in the OPAC interface.
The `bib_list` parameter is modified to append a time-based injection payload:
1); SELECT IF(SUBSTRING(version(),1,1)='5', SLEEP(5), 0);--
Using proxy tools like Burp Suite, the HTTP request is forwarded to the server.
If the server response takes significantly longer than usual, it confirms that the injected conditional statement evaluated to true, enabling character-by-character database extraction.
Protection: from this CVE
Administrators must immediately upgrade Koha Library software to version 23.05.10 or version 22.05.22.
Ensure that Web Application Firewalls (WAF) are configured to detect and block SQL injection signatures and unusual time delays on POST endpoints.
Review database user privileges to follow the principle of least privilege, preventing high-impact data extraction even if an injection vulnerability is present.
Impact:
Successful exploitation allows remote attackers to fully enumerate internal database contents.
Malicious actors can extract sensitive patron details, internal configuration credentials, and password reset tokens.
Account hijacking and complete confidentiality compromise of the library management infrastructure can occur without requiring administrative authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
