SQL injection vulnerability in the MARC framework import/export function…
Priority MEDIUM 46CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.
Why it matters now
EPSS 0.0199 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:* | before 3.08.23; 3.10.00 to before 3.10.13; 3.12.00 to before 3.12.10; 3.14.00 to before 3.14.03 | Vulnerable | Koha |
- cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:* Versions before 3.08.23; 3.10.00 to before 3.10.13; 3.12.00 to before 3.12.10; 3.14.00 to before 3.14.03 Vulnerable ·Koha
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-1925
- 2026-10-03 Alias added: GHSA-6jpq-rw4m-gh6w
References
More Koha vulnerabilities
- TI-2024-18975 An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code… CVSS 3.1CRITICAL 9.6
- TI-2024-18976 Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker… CVSS 3.1CRITICAL 9.6
- TI-2026-24397 Authenticated SQL Injection in Koha displayby parameter of suggestion.pl CVSS 4.0HIGH 8.7
- TI-2024-16095 CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl'… CVSS 3.1HIGH 8.8
- TI-2026-21318 Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via… CVSS 3.1MEDIUM 6.5
- TI-2015-03876 Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before… CVSS 3.0HIGH 7.5
Sources
- CVE-2014-1925 · CVE Program
- CVE-2014-1925 · NVD
- FIRST EPSS
- GHSA-6jpq-rw4m-gh6w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences