SQL Injection in Koha Community Koha

Executive Summary

This vulnerability is an SQL Injection in the reports/catalogue_out.pl script of Koha Community Koha versions through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00.

An authenticated staff user with the Reports module flag can exploit this vulnerability by manipulating the Filter URL parameter when the Criteria parameter matches /branchcode/. The vulnerability arises because the Filter parameter is concatenated directly into a SQL LIKE clause without proper sanitization or use of bound parameters.

This allows error-based SQL injection attacks, enabling the attacker to read arbitrary data from the Koha application database, including sensitive tables such as borrowers (containing password hashes, 2FA secrets, and personally identifiable information), borrower_password_recovery, api_keys, and sessions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the SQL injection in the reports/catalogue_out.pl script of Koha by sending a specially crafted HTTP GET request that includes the Filter parameter with SQL injection payloads.

For example, a proof of concept request to detect the vulnerability is:

• GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&Limit=10&Criteria=branchcode&Filter=x'+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+-

If the response body contains a DBI exception revealing database version, user, or other information, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is significant as it allows an authenticated staff user to read sensitive and confidential data from the Koha database.

• Disclosure of password hashes and two-factor authentication secrets.
• Exposure of personally identifiable information (PII) of borrowers.
• Access to password recovery information.
• Exposure of API keys and session data.

Such data exposure can lead to unauthorized access, identity theft, and compromise of the library system's security and user privacy.

Useful 0 Not Useful 0

Compliance Impact

The SQL Injection vulnerability in Koha allows an authenticated staff user to read arbitrary data from the application database, including sensitive information such as password hashes, 2FA secrets, personally identifiable information (PII), API keys, and session data.

This exposure of sensitive data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive information against unauthorized access.

By enabling unauthorized reading of sensitive data, the vulnerability increases the risk of data breaches, which can result in legal and regulatory consequences under these standards.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Koha to a fixed version where the vulnerability is patched.

• Upgrade to Koha versions 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, or 26.11.00 or later, which replace the vulnerable raw SQL concatenation with parameterised placeholders.

Until an upgrade can be applied, restrict access to the Reports module to trusted authenticated staff users only, as the vulnerability requires authenticated access with the Reports module flag.

Useful 0 Not Useful 0