Koha Library Management System Cross-Site Scripting Vulnerability in OPAC Search

A Cross-Site Scripting (XSS) vulnerability has been identified in the OPAC search feature of Koha Library Management System version 24.05. This vulnerability arises because unsanitized input in the search field is reflected in the search history interface. As a result, arbitrary JavaScript can be executed in the user's browser when interacting with this interface.

Impact

Exploitation of this vulnerability allows for remote code execution in the context of the user's browser.

Reproduction

To reproduce this vulnerability, perform a search using the OPAC search field with an XSS payload, such as an image tag (with an invalid image source) using an 'onerror' attribute. After the search, navigate to the Search History section, where the payload will be executed when the Print button is clicked.