CVE-2025-22954: Koha Library System SQL Injection Flaw

CVE-2025-22954 Overview

CVE-2025-22954 is a critical SQL Injection vulnerability affecting Koha, the open-source Integrated Library System (ILS). The vulnerability exists in the GetLateOrMissingIssues function within C4/Serials.pm and can be exploited through the /serials/lateissues-export.pl endpoint. Attackers can inject malicious SQL commands via the supplierid or serialid parameters, potentially leading to complete database compromise.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the Koha database, potentially exposing sensitive patron data, library records, and enabling full system compromise with a changed scope affecting resources beyond the vulnerable component.

Affected Products

• Koha versions prior to 24.11.02
• Koha Serials module (C4/Serials.pm)
• Koha endpoint /serials/lateissues-export.pl

Discovery Timeline

• 2025-03-12 - CVE CVE-2025-22954 published to NVD
• 2025-03-18 - Last updated in NVD database

Technical Details for CVE-2025-22954

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs in the GetLateOrMissingIssues function located in the C4/Serials.pm Perl module. The function fails to properly sanitize user-supplied input from the supplierid and serialid parameters before incorporating them into SQL queries. This lack of input validation allows attackers to craft malicious requests that inject arbitrary SQL statements directly into database queries.

The vulnerability is particularly severe because it is exposed through a network-accessible endpoint (/serials/lateissues-export.pl) and requires no authentication or user interaction to exploit. Successful exploitation can result in unauthorized access to confidential patron information, modification or deletion of library catalog data, and potential lateral movement to other systems connected to the database.

Root Cause

The root cause of this vulnerability is inadequate input sanitization in the GetLateOrMissingIssues function. The supplierid and serialid parameters are passed directly into SQL query construction without proper parameterized queries or input validation. This allows specially crafted input containing SQL metacharacters to modify the intended query logic.

Attack Vector

The attack vector is network-based, targeting the /serials/lateissues-export.pl endpoint. An attacker can send crafted HTTP requests containing malicious SQL payloads in either the supplierid or serialid parameter. The vulnerability can be exploited remotely without authentication, making it particularly dangerous for internet-facing Koha installations.

The exploitation mechanism involves injecting SQL statements through vulnerable parameters. For example, an attacker could append SQL commands like ' OR '1'='1'; DROP TABLE issues;-- to the parameter values, which would be interpreted as part of the SQL query rather than as literal data. For detailed technical information about the vulnerability mechanism, refer to the Koha Bug #38829 Report.

Detection Methods for CVE-2025-22954

Indicators of Compromise

• Unusual or malformed requests to /serials/lateissues-export.pl containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
• Database error messages appearing in web server logs related to the Serials module
• Unexpected database queries or data modifications in the Koha database audit logs
• Evidence of data exfiltration or unusual database connection patterns

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns targeting the supplierid and serialid parameters
• Monitor web server access logs for requests to /serials/lateissues-export.pl with suspicious parameter values containing SQL metacharacters
• Deploy database activity monitoring to identify anomalous query patterns originating from the Koha application
• Use intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging for the Koha Serials module and monitor for parsing errors or unexpected input patterns
• Configure alerts for multiple failed or unusual requests to the lateissues-export endpoint from single IP addresses
• Implement database query logging to track all queries executed by the Koha application for forensic analysis
• Set up real-time monitoring for changes to critical database tables that could indicate successful exploitation

How to Mitigate CVE-2025-22954

Immediate Actions Required

• Upgrade Koha to version 24.11.02 or later immediately to address this vulnerability
• If immediate patching is not possible, restrict network access to the /serials/lateissues-export.pl endpoint using firewall rules or web server configuration
• Conduct a review of database logs to identify any potential exploitation attempts prior to patching
• Implement input validation at the web server or WAF level to filter SQL injection patterns

Patch Information

The Koha community has released version 24.11.02 which includes a fix for this SQL Injection vulnerability. Organizations running affected versions should upgrade immediately. The patch implements proper input sanitization for the supplierid and serialid parameters in the GetLateOrMissingIssues function.

For complete patch details and upgrade instructions, refer to the Koha Release Announcement 24.11.02 and the Koha Bug #38829 Report.

Workarounds

• Block or restrict access to /serials/lateissues-export.pl at the web server or reverse proxy level until patching is complete
• Deploy a web application firewall rule to sanitize or reject requests containing SQL injection patterns in the supplierid and serialid parameters
• Implement network segmentation to limit database access from compromised web application servers
• Consider temporarily disabling the affected Serials export functionality if it is not critical to library operations

# Apache configuration to restrict access to vulnerable endpoint
<Location /serials/lateissues-export.pl>
    Require ip 192.168.1.0/24
    # Or to completely disable access:
    # Require all denied
</Location>