Koha's reports/issues_avg_stats.pl script constructs dynamic SQL queries by concatenating user-supplied parameters (Line, Column, and Filter) directly into the query string without validation or use of bound parameters. The Line and Column parameters are used verbatim in SQL identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY clauses, while Filter parameters are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. This improper handling leads to a SQL Injection vulnerability (CWE-89) that can be exploited to execute arbitrary SQL commands with the privileges of the application user.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary SQL queries on the Koha database. This can lead to unauthorized data disclosure, modification, or deletion, and potentially disrupt the availability of the affected system. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing the vulnerable reports/issues_avg_stats.pl functionality to untrusted users and consider applying input validation or query parameterization as a temporary mitigation.