gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/reports
History
Jonathan Druart 4617eb7e12 Bug 14426: Escape or use placeholders for sql parameters 
Does this patch enough to prevent sql injection in borrowers_out.pl?

====================================================================
1. "Criteria" Parameter, Payload: ELT(1=1,'evil') / ELT(1=2,'evil')
====================================================================

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
186\r\n\r\nFilter=P_COM&Filter=&Limit=&output=file&basename=Export&MIME=CSV&sep=%3B&report_name=&do_it=1&userid=<username>&password=<password>&branch=&koha_login_context=intranet&Criteria=ELT(1=2,'evil')"
| nc testbox 9002

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
186\r\n\r\nFilter=P_COM&Filter=&Limit=&output=file&basename=Export&MIME=CSV&sep=%3B&report_name=&do_it=1&userid=<username>&password=<password>&branch=&koha_login_context=intranet&Criteria=ELT(1=1,'evil')"
| nc testbox 9002

====================================================================
2. "Filter" Parameter, Payload: P_COM'+AND+'a'='a / P_COM'+AND+'a'='b
====================================================================

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
183\r\n\r\nkoha_login_context=intranet&Limit=&Criteria=branchcode&output=file&basename=Export&MIME=CSV&sep=;&report_name=&do_it=1&userid=<userid>&password=<password>&branch=&Filter=P_COM'+AND+'a'='a"
| nc testbox 9002

echo -ne "POST /cgi-bin/koha/reports/borrowers_out.pl
HTTP/1.1\r\nHost: testbox:9002\r\nContent-Length:
183\r\n\r\nkoha_login_context=intranet&Limit=&Criteria=branchcode&output=file&basename=Export&MIME=CSV&sep=;&report_name=&do_it=1&userid=<userid>&password=<password>&branch=&Filter=P_COM'+AND+'a'='b"
| nc testbox 9002

====================================================================

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Mason James <mtj@kohaaloha.com>
 		2015-07-26 01:20:04 +12:00
..
acquisitions_stats.pl Bug 12151: Remove uses of smartmatch operator in report scripts 2014-09-23 20:51:21 +00:00
bor_issues_top.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
borrowers_out.pl Bug 14426: Escape or use placeholders for sql parameters 2015-07-26 01:20:04 +12:00
borrowers_stats.pl Bug 12151: Remove uses of smartmatch operator in report scripts 2014-09-23 20:51:21 +00:00
cat_issues_top.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
catalogue_out.pl Bug 10718: fix items with no checkouts report 2013-09-08 20:04:43 +00:00
catalogue_stats.pl Bug 7829 - reports/ remove all exit(1) for plack 2012-03-28 16:25:24 +02:00
dictionary.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
guided_reports.pl Bug 14275: Remove CGI::scrolling_list from guided_reports.pl 2015-07-25 16:43:00 +12:00
issues_avg_stats.pl Bug 9457: [ENH] Ordering branches should be case independent (2) 2013-03-20 15:35:58 -04:00
issues_by_borrower_category.plugin Bug 9457: [ENH] Ordering branches should be case independent (2) 2013-03-20 15:35:58 -04:00
issues_stats.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
itemslost.pl Bug 4330 : Fixing FSF address and copyright headers 2012-05-28 17:53:40 +02:00
itemtypes.plugin Bug 9457 - Followup - Ordering branches should be case independent (2) 2013-03-20 15:36:19 -04:00
manager.pl remove a bunch of unconditional debug warns 2010-07-02 10:57:08 -04:00
reports-home.pl Bug 4330 : Fixing FSF address and copyright headers 2012-05-28 17:53:40 +02:00
reservereport.pl Bug 6050 Make calls to GetItemsInfo consistent 2011-06-14 14:12:02 +12:00
reserves_stats.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
serials_stats.pl Bug 11718 - Use new DataTables include in reports templates 2014-03-12 17:33:25 +00:00
stats.print.pl Bug 2505 - Add commented use warnings where missing in the reports/ directory 2010-04-21 20:19:57 +12:00
stats.screen.pl Bug 11715: require authentication for various staff scripts 2014-06-25 22:43:20 +00:00