CVE-2026-6428: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Koha Community Koha
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/. The vulnerable sink in sub calculate concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters: my $f = @$filters[0]; $f =~ s/\*/%/g; $strsth2 .= " AND $column LIKE '$f' "; This enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions. Proof of concept (error-based, single request): GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&Limit=10&Criteria=branchcode&Filter=x'+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+- Cookie: CGISESSID=<LIBRARIAN_SESSION> The response body contains the DBI exception leaking the MariaDB version, database user, client IP, and database name, after which arbitrary data can be paged out using LIMIT n,1 / SUBSTRING(...). The vulnerable sink was introduced in commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 patched the same class in sibling files but did not generalise the fix to reports/catalogue_out.pl. Fixed in Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00 by replacing the raw concatenation with a parameterised placeholder.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-6428) is an SQL Injection in the reports/catalogue_out.pl script of Koha Community Koha. Authenticated staff users with the Reports module flag can exploit the Filter URL parameter when Criteria equals branchcode to inject SQL code due to direct concatenation into a LIKE clause without using bound parameters. The vulnerable code concatenates the Filter parameter directly into the SQL statement, enabling error-based SQL injection techniques such as EXTRACTVALUE to leak database version, user, and other sensitive information. The vulnerability affects multiple Koha versions through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00. The flaw was introduced in 2008 and was fixed by replacing the vulnerable concatenation with parameterized placeholders in the specified fixed versions.
Potential Impact
An authenticated staff user with Reports module privileges can exploit this vulnerability to perform error-based SQL injection, allowing them to read arbitrary data from the Koha application database. This includes sensitive tables containing borrower password hashes, two-factor authentication secrets, personally identifiable information, password recovery data, API keys, and session information. The exposure of such data can lead to unauthorized data disclosure and potential compromise of user accounts and system integrity.
Mitigation Recommendations
Fixed versions are available: Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00. Users should upgrade to these or later versions to remediate the vulnerability. The fix replaces unsafe SQL concatenation with parameterized queries, eliminating the injection vector. No other mitigation is indicated by the vendor advisory.
CVE-2026-6428: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Koha Community Koha
Description
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/. The vulnerable sink in sub calculate concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters: my $f = @$filters[0]; $f =~ s/\*/%/g; $strsth2 .= " AND $column LIKE '$f' "; This enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions. Proof of concept (error-based, single request): GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&Limit=10&Criteria=branchcode&Filter=x'+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+- Cookie: CGISESSID=<LIBRARIAN_SESSION> The response body contains the DBI exception leaking the MariaDB version, database user, client IP, and database name, after which arbitrary data can be paged out using LIMIT n,1 / SUBSTRING(...). The vulnerable sink was introduced in commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 patched the same class in sibling files but did not generalise the fix to reports/catalogue_out.pl. Fixed in Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00 by replacing the raw concatenation with a parameterised placeholder.
CVSS v4.0
Score 5.6medium
Affected software
pkg:github/koha-community/KohaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-6428) is an SQL Injection in the reports/catalogue_out.pl script of Koha Community Koha. Authenticated staff users with the Reports module flag can exploit the Filter URL parameter when Criteria equals branchcode to inject SQL code due to direct concatenation into a LIKE clause without using bound parameters. The vulnerable code concatenates the Filter parameter directly into the SQL statement, enabling error-based SQL injection techniques such as EXTRACTVALUE to leak database version, user, and other sensitive information. The vulnerability affects multiple Koha versions through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00. The flaw was introduced in 2008 and was fixed by replacing the vulnerable concatenation with parameterized placeholders in the specified fixed versions.
Potential Impact
An authenticated staff user with Reports module privileges can exploit this vulnerability to perform error-based SQL injection, allowing them to read arbitrary data from the Koha application database. This includes sensitive tables containing borrower password hashes, two-factor authentication secrets, personally identifiable information, password recovery data, API keys, and session information. The exposure of such data can lead to unauthorized data disclosure and potential compromise of user accounts and system integrity.
Mitigation Recommendations
Fixed versions are available: Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00. Users should upgrade to these or later versions to remediate the vulnerability. The fix replaces unsafe SQL concatenation with parameterized queries, eliminating the injection vector. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TuranSec
- Date Reserved
- 2026-04-16T12:58:10.800Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2d8ec6e617e2d834112b86
Added to database: 06/13/2026, 17:09:26 UTC
Last enriched: 06/20/2026, 19:43:03 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 119
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.