EUVD-2026-52674
GHSA-xxxq-3ww7-6p82
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Web-accessible staff endpoint (AV:N, AC:L); reports module permission required (PR:L); SQL injection scope enables full DB read and plausible write/delete impact (C:H/I:H/A:H), no scope change.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
7DescriptionCVE.org
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY); Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments, and the Limit parameter is appended raw to a LIMIT clause. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
AnalysisAI
SQL injection in Koha's staff-facing report endpoint reports/bor_issues_top.pl enables any authenticated staff member holding the reports module permission to extract arbitrary data from the underlying database, including patron password hashes, two-factor authentication secrets, personal identifying information, API keys, and active session tokens. The vulnerability spans four concurrent release branches (24.11.x, 25.05.x, 25.11.x, 26.05.x) and is addressable by upgrading to patched releases issued by the Koha community. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as 'none' and the attack as non-automatable.
Technical ContextAI
Koha is a widely-adopted open-source Integrated Library System (ILS) written in Perl, used by public, academic, and special libraries worldwide for catalog and circulation management. The vulnerable component is the Perl CGI script reports/bor_issues_top.pl, which generates a staff-facing borrower checkout report. The CWE-89 (SQL Injection) root cause lies in a calculate subroutine that builds dynamic SQL through direct string concatenation rather than parameterized queries. Three distinct injection surfaces exist: (1) the Criteria parameter, which receives only a table-name prefix normalization but is otherwise placed verbatim into SQL identifier positions including SELECT DISTINCTROW, GROUP BY, and ORDER BY clauses - identifier-context injection that is notably resistant to traditional quoting defenses; (2) Filter values, which are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments; and (3) the Limit parameter, appended directly to a LIMIT clause. The Koha database user typically has broad access to the full schema, making the reachable data surface expansive. Affected CPE data covers the 24.11, 25.05, 25.11, and 26.05 release trains.
RemediationAI
Upgrade to a patched release for your active branch: Koha 25.05.12, 25.11.06, 26.05.01, or 24.11.17 as appropriate. The 25.05.12 tarball is available at https://download.koha-community.org/koha-25.05.12.tar.gz and the release announcement at https://koha-community.org/koha-25-05-12-released/; consult the Koha community bugzilla at https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 for branch-specific patch details. If immediate patching is not feasible, restrict the reports module permission to the minimum number of staff accounts operationally required - this reduces the pool of potential attackers from all staff to only those who legitimately need reporting access. Placing the Koha staff client behind a VPN or IP allowlist prevents exploitation from outside the institution network, at the cost of remote staff access. Database-level query audit logging (if supported by your MySQL/MariaDB configuration) can detect anomalous injection patterns post-hoc but does not prevent exploitation. WAF rules targeting SQL metacharacters in the Criteria, Filter, and Limit parameters of bor_issues_top.pl are an unreliable compensating control due to identifier-context injection in ORDER BY/GROUP BY clauses.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today