CVE-2018-1000669 KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnera

What is CVE-2018-1000669?

CVE-2018-1000669 is a high-severity vulnerability in n/a, published on 6 Sep 2018.

Official description

KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11.

Weakness: CWE-352

Which versions are affected by CVE-2018-1000669?

It affects 1 product.

Products include Koha Koha.

How do I fix CVE-2018-1000669?

No fix has been published for CVE-2018-1000669 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-1000669 being exploited?

There is no known exploitation of CVE-2018-1000669 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-1924 SQL injection in n/a Critical 9.8
• CVE-2014-1925 SQL injection in n/a Critical 9.8
• CVE-2015-4633 SQL injection in n/a Critical 9.8
• CVE-2024-28739 Command injection in n/a Critical 9.6
• CVE-2024-24337 Code injection in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p8cm-wxwr-mp27.