Browse Source
A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>16.11.x
2 changed files with 4 additions and 2 deletions
Loading…
Reference in new issue