PT-2024-22550 · Koha Ils · Koha Ils

Febin · Published 2024-08-06 · Updated 2024-08-12 · CVE-2024-28739

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Koha ILS versions 23.05 and earlier

Description The issue allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.

Recommendations For versions 23.05 and earlier, update to a version that contains a fix for this issue.

Exploit

Fix

XSS

Command Injection

Weakness Enumeration

CWE-79

CWE-77

Related Identifiers

CVE-2024-28739

Affected Products

Koha Ils

References · 4

• 🔥 https://febin0x4e4a.wordpress.com/2024/03/07/xss-to-one-click-rce-in-koha-ils · Exploit
• https://osv.dev/vulnerability/CVE-2024-28739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28739 · Security Note
• https://t.me/cvedetector/2629 · Telegram Post