The vulnerability exists in Koha's reports/bor_issues_top.pl script within the subroutine 'calculate', which constructs SQL queries dynamically by directly concatenating several user-controlled request parameters. This improper handling allows an authenticated staff user with the reports module permission to perform SQL Injection attacks. Exploitation can lead to unauthorized reading of any database table accessible by the Koha database user, including sensitive tables containing borrower credentials, two-factor authentication secrets, personal data, API keys, and session data. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, required privileges at the level of an authenticated staff user, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated staff user to execute arbitrary SQL queries on the Koha database, leading to unauthorized disclosure of sensitive information including borrower password hashes, two-factor authentication secrets, personal data, API keys, and session information. This compromises confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict staff user permissions to minimize exposure and avoid granting reports module permissions to untrusted users. Monitor vendor channels for updates and apply patches promptly once released.