Unrated severityNVD Advisory· Published Feb 12, 2024· Updated Sep 29, 2025

CVE-2024-24337

Description

CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Koha/Koha Library Management Systemdescription
Koha/Kohallm-fuzzy
Range: <=23.05.05

Patches

Vulnerability mechanics

References

nitipoom-jar.github.io/CVE-2024-24337/mitre
nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-24337mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000