The Send Basket feature in Koha Library before version 23.05.10 is vulnerable to a time-based SQL injection attack due to improper sanitization of the POST parameter bib_list in the script /cgi-bin/koha/opac-sendbasket.pl. This flaw allows authenticated library users to perform SQL injection that can lead to unauthorized reading of arbitrary database data. The vulnerability is documented under CVE-2024-36058. No patch or official remediation level has been disclosed, and no known exploits have been reported.

Successful exploitation of this vulnerability enables an attacker with access to the Send Basket functionality to extract arbitrary data from the Koha Library database. This could lead to unauthorized disclosure of sensitive library or user information stored in the database. There is no indication of privilege escalation or remote code execution from the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Send Basket functionality or applying input validation controls on the bib_list parameter if possible. Monitor vendor channels for updates regarding patches or official mitigations.