The Send Basket feature in Koha Library prior to version 23.05.10 contains a time-based SQL injection vulnerability due to improper sanitization of the POST parameter bib_list in the script /cgi-bin/koha/opac-sendbasket.pl. This allows unauthenticated attackers to extract arbitrary data from the backend database by leveraging time delays in SQL queries. The vulnerability is tracked as CVE-2024-36058 with a critical CVSS 3.1 score of 9.8, reflecting its potential for full compromise of confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and the software is not a cloud service, so remediation depends on vendor patch releases or user mitigations.

Successful exploitation of this vulnerability allows an unauthenticated attacker to read arbitrary data from the Koha Library database, potentially exposing sensitive information. The CVSS score of 9.8 indicates critical impact affecting confidentiality, integrity, and availability of the affected system. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and monitoring for suspicious activity related to the Send Basket functionality. Avoid exposing the affected interface to untrusted users where possible.