Koha's reports/catalogue_stats.pl script contains a SQL Injection vulnerability (CWE-89) due to unsafe dynamic SQL construction in the 'calculate' subroutine. User-supplied 'Line' and 'Column' parameters are directly embedded into SQL clauses such as SELECT DISTINCTROW, GROUP BY, and ORDER BY without any whitelist validation or sanitization. This enables an attacker with low privileges to inject malicious SQL code, resulting in high impact on confidentiality, integrity, and availability. The vulnerability affects specific Koha versions 25.05.00, 25.11.00, and 26.05.00. No official patch or remediation guidance has been published yet.

Exploitation of this vulnerability can lead to unauthorized disclosure, modification, or deletion of data within the Koha database. Given the high CVSS score (8.8) and the nature of SQL Injection, the impact includes full compromise of data confidentiality, integrity, and availability. The vulnerability requires network access with low privileges and no user interaction, making it relatively easy to exploit if the affected versions are in use.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid exposing the vulnerable reports/catalogue_stats.pl functionality to untrusted users or networks. Implementing input validation or restricting access to this component may reduce risk. Monitor vendor channels for updates and apply official patches once available.