What’s Vulnerable › Vulnerabilities

CVE-2014-1925

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-01-24 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.

Affected products

• Koha Community Koha: before 3.08.23; from 3.10.00 before 3.10.13; from 3.12.00 before 3.12.10; from 3.14.00 before 3.14.03 — fixed in 3.08.23, 3.10.13, 3.12.10, 3.14.03

How to fix

Upgrade to a fixed version: Koha Community Koha 3.08.23, 3.10.13, 3.12.10, 3.14.03. Check the vendor advisory for mitigations.

References

• http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666
• http://koha-community.org/security-release-february-2014/
• http://www.openwall.com/lists/oss-security/2014/02/07/10
• http://www.openwall.com/lists/oss-security/2014/02/10/3
• http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666
• http://koha-community.org/security-release-february-2014/
• http://www.openwall.com/lists/oss-security/2014/02/07/10
• http://www.openwall.com/lists/oss-security/2014/02/10/3

Get alerted when CVE-2014-1925 or the next vulnerability affects your stack