gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/reports
History
Jonathan Druart 96047dba2c Bug 14426: Escape or use placeholders for sql parameters 
Does this patch enough to prevent sql injection in borrowers_out.pl?

====================================================================
1. "Criteria" Parameter, Payload: ELT(1=1,'evil') / ELT(1=2,'evil')
====================================================================

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
186\r\n\r\nFilter=P_COM&Filter=&Limit=&output=file&basename=Export&MIME=CSV&sep=%3B&report_name=&do_it=1&userid=<username>&password=<password>&branch=&koha_login_context=intranet&Criteria=ELT(1=2,'evil')"
| nc testbox 9002

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
186\r\n\r\nFilter=P_COM&Filter=&Limit=&output=file&basename=Export&MIME=CSV&sep=%3B&report_name=&do_it=1&userid=<username>&password=<password>&branch=&koha_login_context=intranet&Criteria=ELT(1=1,'evil')"
| nc testbox 9002

====================================================================
2. "Filter" Parameter, Payload: P_COM'+AND+'a'='a / P_COM'+AND+'a'='b
====================================================================

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
183\r\n\r\nkoha_login_context=intranet&Limit=&Criteria=branchcode&output=file&basename=Export&MIME=CSV&sep=;&report_name=&do_it=1&userid=<userid>&password=<password>&branch=&Filter=P_COM'+AND+'a'='a"
| nc testbox 9002

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
183\r\n\r\nkoha_login_context=intranet&Limit=&Criteria=branchcode&output=file&basename=Export&MIME=CSV&sep=;&report_name=&do_it=1&userid=<userid>&password=<password>&branch=&Filter=P_COM'+AND+'a'='b"
| nc testbox 9002

====================================================================

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
 		2015-06-23 12:33:39 +12:00
..
acquisitions_stats.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
bor_issues_top.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
borrowers_out.pl Bug 14426: Escape or use placeholders for sql parameters 2015-06-23 12:33:39 +12:00
borrowers_stats.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
cat_issues_top.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
catalogue_out.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
catalogue_stats.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
dictionary.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
guided_reports.pl Bug 14275: Remove CGI::scrolling_list from guided_reports.pl 2015-06-08 10:53:50 +12:00
issues_avg_stats.pl Bug 14279: Remove CGI::scrolling_list from issues_avg_stats.pl 2015-06-08 13:28:55 +12:00
issues_by_borrower_category.plugin Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
issues_stats.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
itemslost.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
itemtypes.plugin Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
manager.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
reports-home.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
reservereport.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
reserves_stats.pl Bug 12707: Remove CGI::scrolling_list from some Reports 2014-08-15 14:47:23 -03:00
serials_stats.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
stats.print.pl Bug 2505 - Add commented use warnings where missing in the reports/ directory 2010-04-21 20:19:57 +12:00
stats.screen.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00