gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/reports
History
Jonathan Druart 533186576b Bug 14426: Escape or use placeholders for sql parameters 
Does this patch enough to prevent sql injection in borrowers_out.pl?

====================================================================
1. "Criteria" Parameter, Payload: ELT(1=1,'evil') / ELT(1=2,'evil')
====================================================================

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
186\r\n\r\nFilter=P_COM&Filter=&Limit=&output=file&basename=Export&MIME=CSV&sep=%3B&report_name=&do_it=1&userid=<username>&password=<password>&branch=&koha_login_context=intranet&Criteria=ELT(1=2,'evil')"
| nc testbox 9002

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
186\r\n\r\nFilter=P_COM&Filter=&Limit=&output=file&basename=Export&MIME=CSV&sep=%3B&report_name=&do_it=1&userid=<username>&password=<password>&branch=&koha_login_context=intranet&Criteria=ELT(1=1,'evil')"
| nc testbox 9002

====================================================================
2. "Filter" Parameter, Payload: P_COM'+AND+'a'='a / P_COM'+AND+'a'='b
====================================================================

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
183\r\n\r\nkoha_login_context=intranet&Limit=&Criteria=branchcode&output=file&basename=Export&MIME=CSV&sep=;&report_name=&do_it=1&userid=<userid>&password=<password>&branch=&Filter=P_COM'+AND+'a'='a"
| nc testbox 9002

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
183\r\n\r\nkoha_login_context=intranet&Limit=&Criteria=branchcode&output=file&basename=Export&MIME=CSV&sep=;&report_name=&do_it=1&userid=<userid>&password=<password>&branch=&Filter=P_COM'+AND+'a'='b"
| nc testbox 9002

====================================================================

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit f260c56838)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
 		2015-06-23 14:26:05 +02:00
..
acquisitions_stats.pl Bug 8068: Standardize terms used on acquisitions statistics 2013-04-25 22:06:08 -04:00
bor_issues_top.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
borrowers_out.pl Bug 14426: Escape or use placeholders for sql parameters 2015-06-23 14:26:05 +02:00
borrowers_stats.pl Bug 9451: Quiet warnings and Plackify borrower_stats.pl 2013-02-08 08:42:32 -05:00
cat_issues_top.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
catalogue_out.pl Bug 10718: fix items with no checkouts report 2013-09-08 20:04:43 +00:00
catalogue_stats.pl Bug 7829 - reports/ remove all exit(1) for plack 2012-03-28 16:25:24 +02:00
dictionary.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
guided_reports.pl Bug 3134: add ability to selelct multiple reports to delete at once 2013-08-21 14:24:33 +00:00
issues_avg_stats.pl Bug 9457: [ENH] Ordering branches should be case independent (2) 2013-03-20 15:35:58 -04:00
issues_by_borrower_category.plugin Bug 9457: [ENH] Ordering branches should be case independent (2) 2013-03-20 15:35:58 -04:00
issues_stats.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
itemslost.pl Bug 4330 : Fixing FSF address and copyright headers 2012-05-28 17:53:40 +02:00
itemtypes.plugin Bug 9457 - Followup - Ordering branches should be case independent (2) 2013-03-20 15:36:19 -04:00
manager.pl remove a bunch of unconditional debug warns 2010-07-02 10:57:08 -04:00
reports-home.pl Bug 4330 : Fixing FSF address and copyright headers 2012-05-28 17:53:40 +02:00
reservereport.pl Bug 6050 Make calls to GetItemsInfo consistent 2011-06-14 14:12:02 +12:00
reserves_stats.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
serials_stats.pl Bug 11718 - Use new DataTables include in reports templates 2014-06-12 09:14:56 +02:00
stats.print.pl Bug 2505 - Add commented use warnings where missing in the reports/ directory 2010-04-21 20:19:57 +12:00
stats.screen.pl Bug 11715: require authentication for various staff scripts 2014-06-26 14:08:24 +02:00