EUVD-2026-52673
GHSA-24c7-g2cg-jw93
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web endpoint, low-privilege staff credential required (PR:L), no user interaction, full DB read confirmed and write plausible given typical Koha DB user grants.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
7DescriptionCVE.org
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
AnalysisAI
SQL injection in Koha's reports module allows an authenticated staff user with the reports permission to execute arbitrary SQL against the Koha database via reports/issues_avg_stats.pl. The Line and Column HTTP parameters are inserted verbatim into SQL identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY) and Filter slots are concatenated raw into comparison predicates without parameterized queries, exposing the full Koha database to read and potential write operations. Sensitive tables including borrowers (password hashes, two-factor secrets, patron PII), api_keys, and sessions are all reachable; no public exploit identified at time of analysis and CISA KEV does not list this CVE.
Technical ContextAI
Koha is an open-source integrated library system (ILS) written primarily in Perl. The vulnerability resides in the calculate subroutine within reports/issues_avg_stats.pl, which constructs SQL dynamically by string-concatenating user-supplied HTTP request parameters rather than using parameterized queries or prepared statements. The Line and Column parameters land directly in SQL identifier positions - SELECT DISTINCTROW, GROUP BY, and ORDER BY clauses - where standard quoting does not apply and whitelist validation is absent. Filter slot values are concatenated raw into single-quoted LIKE, BETWEEN, and equality predicates, making them susceptible to classic quote-escape injection. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the precise root cause: the Perl code treats user input as trusted query structure rather than as data to be bound. The Koha database user in a typical deployment holds broad DML privileges across all library tables, amplifying the blast radius of any successful injection.
RemediationAI
Upgrade to a fixed release: Koha 24.11.17, 25.11.06, 25.05.12, or 26.05.01, as documented in the release announcement at https://koha-community.org/koha-25-05-12-released/ and the upstream bug report at https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368. The 25.05.12 tarball is available at https://download.koha-community.org/koha-25.05.12.tar.gz. Where immediate patching is not possible, revoke the reports module permission from all staff accounts that do not operationally require it - this directly eliminates the exposed attack surface since the vulnerable endpoint enforces that permission check before execution; the trade-off is loss of ad-hoc reporting capability for those users. Additionally, restrict Koha's database user to the minimum required privileges and consider placing the Koha database on a network segment inaccessible from general staff workstations, reducing lateral data exfiltration paths. Audit reports/issues_avg_stats.pl access in web server logs for anomalous or encoded parameter values as an interim detection control.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today