CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
References
Link | Resource |
---|---|
https://nitipoom-jar.github.io/CVE-2024-24337/ |
Configurations
No configuration.
History
26 Aug 2024, 19:35
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
CWE | CWE-1236 |
12 Feb 2024, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-02-12 22:15
Updated : 2024-08-26 19:35
NVD link : CVE-2024-24337
Mitre link : CVE-2024-24337
CVE.ORG link : CVE-2024-24337
JSON object : View
Products Affected
No product.
CWE
CWE-1236
Improper Neutralization of Formula Elements in a CSV File