CVE-2024-36058: Koha Library SQL Injection Vulnerability

CVE-2024-36058 Overview

CVE-2024-36058 is a critical Time-Based SQL Injection vulnerability affecting the Send Basket functionality in Koha Library software versions prior to 23.05.10. The vulnerability exists due to insufficient input sanitization of the bib_list POST parameter in the /cgi-bin/koha/opac-sendbasket.pl endpoint, allowing authenticated library users to extract arbitrary data from the underlying database through time-based blind SQL injection techniques.

Critical Impact

This SQL injection vulnerability allows attackers with library user access to read sensitive data from the database, potentially exposing patron information, credentials, and other confidential library records.

Affected Products

• Koha Library Software versions prior to 23.05.10
• Koha Library Software versions prior to 22.05.22

Discovery Timeline

• 2026-04-07 - CVE-2024-36058 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2024-36058

Vulnerability Analysis

This vulnerability represents a classic example of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The Send Basket feature in Koha Library allows users to share selected bibliography items via email. The affected endpoint /cgi-bin/koha/opac-sendbasket.pl accepts a POST parameter called bib_list which contains bibliographic record identifiers. When this parameter is processed, the application fails to properly sanitize user input before incorporating it into SQL queries.

The time-based nature of this SQL injection means that attackers cannot see query results directly in the HTTP response. Instead, they must infer database contents by injecting SQL statements that conditionally delay the server's response based on whether specific conditions are true or false. This technique, while slower than error-based or union-based SQL injection, still allows complete database extraction over time.

Root Cause

The root cause of this vulnerability is the absence of proper input validation and parameterized queries in the opac-sendbasket.pl CGI script. The bib_list parameter is directly concatenated into SQL queries without sanitization, escaping, or the use of prepared statements. This coding practice violates secure development principles and allows malicious SQL syntax to be interpreted by the database engine.

Attack Vector

The attack can be executed remotely over the network by any authenticated library user. An attacker would craft malicious payloads within the bib_list POST parameter containing time-based SQL injection techniques such as SLEEP() functions (MySQL) or pg_sleep() (PostgreSQL) combined with conditional statements.

The attacker submits specially crafted requests to the vulnerable endpoint and measures response times. By systematically querying character-by-character with conditional delays, the attacker can extract database table names, column names, and sensitive data values. Automated tools like SQLMap can significantly accelerate this extraction process, making full database compromise achievable in a matter of hours.

Detection Methods for CVE-2024-36058

Indicators of Compromise

• Unusual or repeated POST requests to /cgi-bin/koha/opac-sendbasket.pl with abnormally long or malformed bib_list parameter values
• HTTP requests containing SQL keywords such as SLEEP, BENCHMARK, WAITFOR, pg_sleep, or IF() in POST data
• Database query logs showing abnormally long-running queries originating from the OPAC basket functionality
• Patterns of requests with incrementing or sequential timing behavior indicating automated extraction attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST parameters targeting Koha endpoints
• Enable and monitor database slow query logs for queries with unusual delay patterns or SQL injection syntax
• Deploy application-layer intrusion detection systems configured with signatures for time-based SQL injection attack patterns
• Analyze web server access logs for high-frequency requests to the affected endpoint from single IP addresses

Monitoring Recommendations

• Configure alerting for any requests to /cgi-bin/koha/opac-sendbasket.pl containing SQL injection indicators in the bib_list parameter
• Monitor database server CPU and query execution times for anomalies that may indicate active exploitation
• Implement rate limiting on the Send Basket functionality to slow potential automated extraction attempts
• Enable verbose logging for the Koha OPAC module to capture full request details for forensic analysis

How to Mitigate CVE-2024-36058

Immediate Actions Required

• Upgrade Koha Library Software to version 23.05.10 or later immediately to patch this vulnerability
• If immediate patching is not possible, disable or restrict access to the Send Basket functionality until the update can be applied
• Review database access logs for any signs of exploitation and conduct a security audit of potentially exposed data
• Consider implementing a Web Application Firewall (WAF) as an additional defensive layer

Patch Information

The Koha Community has released security patches addressing this vulnerability. Administrators should update to Koha version 23.05.10 or 22.05.22 (for the older release branch) which contain the necessary fixes. Detailed release notes are available at the GitLab Koha Release Notes 23.05.10 and additional information can be found in the Koha Community Release Announcement.

Workarounds

• Disable the Send Basket functionality by restricting access to /cgi-bin/koha/opac-sendbasket.pl through web server configuration until patching is completed
• Implement strict input validation at the web server or reverse proxy level to reject requests containing SQL injection patterns
• Deploy a WAF rule to block requests with suspicious characters or SQL syntax in POST parameters to Koha OPAC endpoints
• Restrict OPAC access to trusted IP ranges if public access is not required during the remediation window

# Apache configuration to temporarily disable Send Basket endpoint
<Location /cgi-bin/koha/opac-sendbasket.pl>
    Require all denied
    # Optionally log blocked attempts
    LogLevel warn
</Location>