CVE-2014-1925

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666Exploit, Issue Tracking, Vendor Advisory
http://koha-community.org/security-release-february-2014/Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/02/07/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/02/10/3Mailing List, Third Party Advisory
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666Exploit, Issue Tracking, Vendor Advisory
http://koha-community.org/security-release-february-2014/Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/02/07/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/02/10/3Mailing List, Third Party Advisory

Timeline

Published: Jan 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-19277.5The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrar CVE-2014-19284.6The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbi CVE-2014-19294.4python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection throu CVE-2014-19304.3Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to preven CVE-2014-19314.3The user login page in Visibility Software Cyber Recruiter before 8.1.00 generates different responses for invalid password-retrieval attemp CVE-2014-19324.4The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, a CVE-2014-19332.1The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses th CVE-2014-19343.3tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack o CVE-2014-19355.39base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.CVE-2014-19367.5rc before 1.7.1-5 insecurely creates temporary files.CVE-2014-19377.5Gamera before 3.4.1 insecurely creates temporary files.CVE-2014-19385.5python-rply before 0.7.4 insecurely creates temporary files.