Описание
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
EPSS
8 High
CVSS3
8.8 High
CVSS3
Дефекты
Связанные уязвимости
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aq ...
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
Уязвимость компонентов members/moremember.pl и admin/aqbudgets.pl программного обеспечения автоматизации библиотечных процессов Koha, позволяющая нарушителю выполнить произвольные команды
EPSS
8 High
CVSS3
8.8 High
CVSS3