CVE-2026-70370
Received Received - Intake

SQL Injection in Koha Reports Module

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation. When Line contains itemcallnumber and the cotedigits parameter is truthy, cotedigits is additionally concatenated raw as the numeric argument of a LEFT() call. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-70370
EUVD
EUVD-2026-52672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
koha koha *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in Koha's catalogue_stats.pl report module. An authenticated staff user with reports module permissions can inject malicious SQL code through the Line and Column parameters. The vulnerability occurs because user input is directly interpolated into SQL query identifiers without validation. This allows attackers to read any database table accessible by the Koha database user, including sensitive data like borrower information, passwords, API keys, and session data.

Detection Guidance

Check Koha logs for suspicious SQL queries in reports/catalogue_stats.pl. Look for requests with Line=itemcallnumber and cotedigits parameters. Inspect database access patterns for unauthorized queries targeting borrowers, api_keys, or sessions tables.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data including patron personal information, authentication credentials, and system configurations. Attackers could steal passwords, two-factor authentication secrets, borrower records, or manipulate the system to perform unauthorized actions. The impact depends on the permissions of the Koha database user account.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR and HIPAA by exposing personal and sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in unauthorized data access, triggering compliance violations, potential fines, and reputational damage for organizations handling regulated data.

Mitigation Strategies
  • Upgrade to Koha 25.05.12 or later to apply security patches addressing SQL injection in report modules.
  • Restrict staff user permissions to only necessary report modules and database access.
  • Monitor database queries for anomalies and block unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70370. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart