CVE-2025-22954

CVE-2025-22954 is a SQL injection flaw in the GetLateOrMissingIssues function in Koha's C4/Serials.pm, reachable through the /serials/lateissues-export.pl script when an attacker submits crafted input in the supplierid or serialid parameters. The CVSS vector (AV:N, AC:L, PR:N, UI:N, scope changed, high confidentiality/integrity/availability impact) indicates the flaw is network-exploitable with no authentication or user interaction, and that an attacker can move beyond the vulnerable component — gaining the ability to read, alter, or tamper with the underlying Koha database, which can include bibliographic, serials, and patron records. Affected organizations are those running Koha, the open-source integrated library system, in versions before 24.11.02, primarily libraries that use the serials module. No public proof-of-concept or confirmed in-the-wild exploitation is known at this time, and the issue is not on the CISA KEV catalog; however, an EPSS score of 25.6% (98th percentile) indicates a meaningful probability of exploitation within the next 30 days.

What to do: Upgrade Koha to version 24.11.02 or later to obtain the fix. Until patched, restrict network access to the staff interface path /serials/lateissues-export.pl and, where possible, apply WAF/input-validation filtering on the supplierid and serialid parameters. Review web access logs for anomalous requests to lateissues-export.pl containing SQL metacharacters in those parameters to check for attempted exploitation.