Koha Community
Monthly
SQL injection in Koha's acquisition module enables authenticated staff to blindly extract the entire database - including patron PII, staff bcrypt password hashes, and two-factor authentication secrets - via a crafted ORDER BY direction token in the acqui/parcels.pl endpoint. All active Koha release branches are affected through versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01, meaning any library running a current release is exposed. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but successful exploitation yields credentials that could cascade into full staff account takeover.
Stored SQL injection in Koha library management software allows authenticated staff holding the items_batchmod permission to plant unsanitized SQL inside the 'automatic item modifications by age' configuration tool, which is later executed verbatim by the scheduled cron job through C4::Items::ToggleNewStatus. Successful exploitation exposes the entire Koha database - including patron personally identifiable information and staff password hashes - and lets the attacker manipulate which library items the batch modification job processes. No CISA KEV listing and no public exploit code have been identified at time of analysis; the deferred, cron-triggered execution model decouples the attacker's action from the database impact, complicating real-time detection.
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holding the low-privilege `create_reports` or `execute_reports` permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The `order_by` and dynamically-named `{order}_ovalue` CGI parameters are concatenated verbatim into an ORDER BY clause by `C4::Reports::Guided` with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.
Stored SQL injection in Koha across all active release branches (24.11, 25.05, 25.11, 26.05) allows authenticated library staff holding the edit_borrowers permission to plant a compact time-based SLEEP payload in a patron's lang field, causing recurring denial-of-service each time an issue slip is printed for that patron. The 25-character column constraint prevents practical data extraction, confining real-world impact strictly to workflow disruption in the circulation slip-printing path. No public exploit code or active exploitation has been identified at time of analysis; the attack requires valid staff credentials scoped to a specific Koha permission.
Stored SQL injection in Koha's patron card layout feature allows authenticated staff with the label_creator permission to exfiltrate the entire library database, including patron PII and staff bcrypt password hashes. The image_name field is persisted verbatim into layout XML without sanitization and later concatenated raw into a SQL query inside patroncards/create-pdf.pl when a patron card batch is printed, creating a second-order injection that fires on a routine staff action. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and low privilege requirement make this a meaningful priority for library operators running affected releases.
SQL injection in Koha's reports/catalogue_out.pl grants authenticated staff with the Reports module flag full read access to the Koha MariaDB database, including borrower password hashes, 2FA secrets, API keys, session tokens, and patron PII. The vulnerability traces to a 2008 commit and was overlooked when CVE-2015-4633 patched the same injection class in sibling files. A working single-request proof-of-concept using EXTRACTVALUE error-based extraction has been publicly disclosed; no CISA KEV listing has been confirmed at time of analysis, but the low exploitation barrier for credentialed staff makes this a high-priority remediation.
File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Koha's acquisition module enables authenticated staff to blindly extract the entire database - including patron PII, staff bcrypt password hashes, and two-factor authentication secrets - via a crafted ORDER BY direction token in the acqui/parcels.pl endpoint. All active Koha release branches are affected through versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01, meaning any library running a current release is exposed. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but successful exploitation yields credentials that could cascade into full staff account takeover.
Stored SQL injection in Koha library management software allows authenticated staff holding the items_batchmod permission to plant unsanitized SQL inside the 'automatic item modifications by age' configuration tool, which is later executed verbatim by the scheduled cron job through C4::Items::ToggleNewStatus. Successful exploitation exposes the entire Koha database - including patron personally identifiable information and staff password hashes - and lets the attacker manipulate which library items the batch modification job processes. No CISA KEV listing and no public exploit code have been identified at time of analysis; the deferred, cron-triggered execution model decouples the attacker's action from the database impact, complicating real-time detection.
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holding the low-privilege `create_reports` or `execute_reports` permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The `order_by` and dynamically-named `{order}_ovalue` CGI parameters are concatenated verbatim into an ORDER BY clause by `C4::Reports::Guided` with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.
Stored SQL injection in Koha across all active release branches (24.11, 25.05, 25.11, 26.05) allows authenticated library staff holding the edit_borrowers permission to plant a compact time-based SLEEP payload in a patron's lang field, causing recurring denial-of-service each time an issue slip is printed for that patron. The 25-character column constraint prevents practical data extraction, confining real-world impact strictly to workflow disruption in the circulation slip-printing path. No public exploit code or active exploitation has been identified at time of analysis; the attack requires valid staff credentials scoped to a specific Koha permission.
Stored SQL injection in Koha's patron card layout feature allows authenticated staff with the label_creator permission to exfiltrate the entire library database, including patron PII and staff bcrypt password hashes. The image_name field is persisted verbatim into layout XML without sanitization and later concatenated raw into a SQL query inside patroncards/create-pdf.pl when a patron card batch is printed, creating a second-order injection that fires on a routine staff action. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and low privilege requirement make this a meaningful priority for library operators running affected releases.
SQL injection in Koha's reports/catalogue_out.pl grants authenticated staff with the Reports module flag full read access to the Koha MariaDB database, including borrower password hashes, 2FA secrets, API keys, session tokens, and patron PII. The vulnerability traces to a 2008 commit and was overlooked when CVE-2015-4633 patched the same injection class in sibling files. A working single-request proof-of-concept using EXTRACTVALUE error-based extraction has been publicly disclosed; no CISA KEV listing has been confirmed at time of analysis, but the low exploitation barrier for credentialed staff makes this a high-priority remediation.
File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.