CVE-2025-30076
7.7
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Summary
Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Koha | Koha | 0 < 22.11.24 | affected |
| Koha | Koha | 23 < 23.11.12 | affected |
| Koha | Koha | 24 < 24.05.07 | affected |
| Koha | Koha | 24.06 < 24.11.02 | affected |
Weaknesses
- CWE-78: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: total
Additional References
References
- https://github.com/gl0wyy/koha-task-scheduler-rce
- https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39170
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.