{"push_id":703776761,"size":1,"distinct_size":1,"ref":"refs/heads/3.14.x","head":"3e6ad12ee87e8905f042091ae5d324524412f5d0","before":"4631b30b2fa4d379a09db4b7822753ade29b6df8","commits":[{"sha":"3e6ad12ee87e8905f042091ae5d324524412f5d0","author":{"email":"d7aa3da1d5912a8b3f7b831e4f9f40b8b3d7e8b1@catalyst.net.nz","name":"Chris Cormack"},"message":"Bug 14412: SQL injection possible\n\nThere is a SQL Injection vulnerability in the\n/cgi-bin/koha/opac-tags_subject.pl script.\n\nBy manipulating the variable 'number', the database can be accessed\nvia time-based blind injections.\n\nThe following string serves as an example:\n\n/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)\n\nTo exploit the vulnerability, no authentication is needed\n\nTo test\n1/ Turn on mysql query logging\n2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)\n3/ Check the logs notice something like\n  SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1\n  PROCEDURE ANALYSE\n  (EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)\n4/ Apply patch\n5/ Hit the url again\n6/ Notice the log now only has\n   SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1\n\nSigned-off-by: Jonathan Druart <jonathan.druart@koha-community.org>\nSigned-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>\nConfirmed the problem and the fix for it.\nSigned-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>\n\n(cherry picked from commit 57b01fb655955ac630d6018d03f4d134e7e3e25a)\nSigned-off-by: Chris Cormack <chrisc@catalyst.net.nz>\n(cherry picked from commit b414b22bf063d58e0e2255a648097cf9111ab445)\nSigned-off-by: Fridolin Somers <fridolin.somers@biblibre.com>","distinct":true,"url":"https://api.github.com/repos/Koha-Community/Koha/commits/3e6ad12ee87e8905f042091ae5d324524412f5d0"}]}