CVE-2015-4633

Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.

• CWE-89

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14412Exploit, Issue Tracking
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426Exploit, Issue Tracking, Third Party Advisory
• https://koha-community.org/koha-3-14-16-released/Release Notes
• https://koha-community.org/security-release-koha-3-16-12/Release Notes
• https://koha-community.org/security-release-koha-3-18-8/Release Notes
• https://koha-community.org/security-release-koha-3-20-1/Release Notes
• https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2015/Jun/80Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/37387/Exploit, Third Party Advisory, VDB Entry
• https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/Exploit, Release Notes, Third Party Advisory
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14412Exploit, Issue Tracking
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426Exploit, Issue Tracking, Third Party Advisory
• https://koha-community.org/koha-3-14-16-released/Release Notes
• https://koha-community.org/security-release-koha-3-16-12/Release Notes
• https://koha-community.org/security-release-koha-3-18-8/Release Notes
• https://koha-community.org/security-release-koha-3-20-1/Release Notes
• https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2015/Jun/80Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/37387/Exploit, Third Party Advisory, VDB Entry
• https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/Exploit, Release Notes, Third Party Advisory

Published

Oct 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4627SQL injection vulnerability in Pragyan CMS 3.0.
• CVE-2015-4628SQL injection vulnerability in application/controllers/admin…
• CVE-2015-4629Huawei E5756S before V200R002B146D23SP00C00 allows remote at…
• CVE-2015-4630Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-4631Multiple cross-site scripting (XSS) vulnerabilities in Koha …
• CVE-2015-4632Multiple directory traversal vulnerabilities in Koha 3.14.x …
• CVE-2015-4634SQL injection vulnerability in graphs.php in Cacti before 0.…
• CVE-2015-4637The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 …
• CVE-2015-4638The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analyt…
• CVE-2015-4639Cross-site scripting (XSS) vulnerability in opac-addbybiblio…
• CVE-2015-4640The SwiftKey language-pack update implementation on Samsung …
• CVE-2015-4641Directory traversal vulnerability in the SwiftKey language-p…