Description (CNA)
Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Koha / Koha | affected 0 before 22.11.24; affected 23 before 23.11.12; affected 24 before 24.05.07; affected 24.06 before 24.11.02 |
CWE
CWE-78
References
- https://github.com/gl0wyy/koha-task-scheduler-rce
- https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39170
ADP enrichment
No English description supplied.