PT-2022-13213 · Parantez Teknoloji · Koha

Published 2022-09-21 · Updated 2026-05-20 · CVE-2022-0495

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions KOHA versions prior to 19.05.03

Description The library automation system product KOHA developed by Parantez Teknoloji has an unauthenticated SQL Injection vulnerability. This issue has been fixed in version 19.05.03.01.

Recommendations For versions prior to 19.05.03, update to version 19.05.03.01 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive database queries until a patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0495

Affected Products

Koha

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-0495 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0495 · Vendor Advisory
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0635 · Note
• https://t.me/cveNotify/164170 · Telegram Post
• https://t.me/cibsecurity/50183 · Telegram Post
• https://usom.gov.tr/bildirim/tr-22-0635 · Note
• https://t.me/cvenotify/94852 · Telegram Post