CVE-2024-24337

HIGH

Koha Library Management System <23.05.05 - CSV Injection

Title source: llm
STIX 2.1

Description

CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.

References (2)

Scores

CVSS v3 8.0
EPSS 0.0297
EPSS Percentile 86.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-1236
Status published
Products (1)
koha/koha < 23.05.05
Published Feb 12, 2024
Tracked Since Feb 18, 2026