PT-2024-3869 · Unknown · Library Management System

Nitipoom Jaroonchaipipat · Published 2024-02-06 · Updated 2024-10-16 · CVE-2024-24337

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Koha Library Management System versions 23.05.05 and earlier

Description The issue is related to a lack of neutralization of elements in a CSV file, affecting the components members/moremember.pl and admin/aqbudgets.pl. This allows a remote attacker to execute arbitrary DDE commands by sending a specially crafted CSV file. The vulnerability can be exploited via the 'Budget' and 'Patrons Member' components.

Recommendations For Koha Library Management System versions 23.05.05 and earlier, consider disabling the /members/moremember.pl and /admin/aqbudgets.pl endpoints until a patch is available. Restrict access to the 'Budget' and 'Patrons Member' components to minimize the risk of exploitation. Avoid using these components to export CSV files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BDU:2024-04270

CVE-2024-24337

Affected Products

Library Management System

References · 9

• 🔥 https://nitipoom-jar.github.io/CVE-2024-24337 · Exploit
• https://bdu.fstec.ru/vul/2024-04270 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-24337 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24337 · Vendor Advisory
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-24337 · Note
• https://t.me/cvenotify/98304 · Telegram Post
• https://t.me/cvenotify/92224 · Telegram Post
• https://twitter.com/CVEnew/status/1757156996011204660 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757184434611122266 · Twitter Post