PT-2023-10270 · Bywater Solutions · Bywater-Koha-Xslt

Published 2023-03-06 · Updated 2024-05-17 · CVE-2015-10091

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ByWater Solutions bywater-koha-xslt (affected versions not specified)

Description A critical vulnerability has been found in ByWater Solutions bywater-koha-xslt, affecting the StringSearch function of the file admin/systempreferences.pl. The manipulation of the name argument leads to SQL injection. The attack can be initiated remotely. The product uses continuous delivery with rolling releases, and therefore, no version details of affected or updated releases are available.

Recommendations Apply a patch to fix this issue, specifically the patch identified as 9513b93c828dfbc4413f9e0df63647401aaf4e58. As a temporary workaround, consider restricting access to the StringSearch function in the admin/systempreferences.pl file until the patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-10091

Affected Products

Bywater-Koha-Xslt

References · 7

• https://github.com/bywatersolutions/bywater-koha-xslt/commit/9513b93c828dfbc4413f9e0df63647401aaf4e58 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10091 · Security Note
• https://t.me/cvenotify/45562 · Telegram Post
• https://t.me/cvenotify/64323 · Telegram Post
• https://vuldb.com/?ctiid.222322 · Note
• https://vuldb.com/?id.222322 · Note
• https://t.me/cibsecurity/59448 · Telegram Post