EUVD-2026-52671
GHSA-3c33-363c-r2wh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable staff interface, low complexity injection; PR:L reflects mandatory reports-permission staff account; C:H/I:H/A:H justified by unrestricted SQL execution against the full Koha schema.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
7DescriptionCVE.org
Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The statement is prepared and executed with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions.
AnalysisAI
SQL injection in Koha's acquisitions statistics module exposes sensitive library patron data to authenticated staff. The reports/acquisitions_stats.pl endpoint interpolates nine user-controlled Filter parameters directly into SQL WHERE fragments without prepared-statement binding, giving any staff account holding the reports permission arbitrary read access to the Koha database - including borrower password hashes, two-factor secrets, API keys, and active session tokens. No public exploit or active exploitation has been identified, but the attack is straightforward for any insider or compromised staff account.
Technical ContextAI
Koha is a Perl-based open-source integrated library system (ILS). The vulnerability exists in the calculate subroutine of reports/acquisitions_stats.pl, which constructs dynamic SQL queries for acquisitions reporting. Nine HTTP Filter request parameters - covering fields across aqbasket, aqorders, aqbooksellers, items, biblioitems, and aqbudgets tables - are string-interpolated directly into WHERE clause fragments before statement preparation, violating the parameterized-query contract that DBI provides. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause. Because the Koha database user typically has broad access to the schema, successful injection can reach tables outside the reporting context, including borrowers (which stores bcrypt password hashes and TOTP secrets), borrower_password_recovery, api_keys, and sessions.
RemediationAI
Upgrade to Koha 24.11.17, 25.05.12, 25.11.06, or 26.05.01 - whichever matches the installed release series. The 25.05.12 tarball is available at https://download.koha-community.org/koha-25.05.12.tar.gz and the release announcement at https://koha-community.org/koha-25-05-12-released/. If immediate patching is not feasible, restrict the reports module permission to only those staff accounts that operationally require acquisitions reporting - this reduces the exploitable population. Additionally, consider restricting the Koha database user's privileges to SELECT-only on sensitive tables (borrowers, api_keys, sessions, borrower_password_recovery) where the application permits; note that this may break other Koha functionality if the same DB user is used for writes, so test carefully in staging. WAF rules blocking SQL metacharacters in Filter parameters can provide a partial signal but are not a reliable control given the variety of injection vectors across nine parameters.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today