CVE-2022-0495

Published: Sep 21, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD (Secondary)

Description

The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.

Affected (1)

Products: Parantezteknoloji: Koha Library Automation

Parantezteknoloji

1 product

Koha Library Automation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Parantezteknoloji Koha Library Automation	Before 19.05.03.01

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (3)

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0635

Source: iletisim@usom.gov.tr

https://www.usom.gov.tr/bildirim/tr-22-0635

Source: iletisim@usom.gov.tr

Third Party Advisory

https://www.usom.gov.tr/bildirim/tr-22-0635

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.