The vulnerability in Koha's reports/issues_stats.pl script arises from unsafe construction of SQL queries in the subroutine 'calculate'. User input parameters such as PeriodTypeSel, PeriodDaySel, PeriodMonthSel, Filter slots, and Line and Column identifiers are directly interpolated into SQL query strings without any whitelist validation or use of parameterized queries. This improper handling leads to SQL Injection (CWE-89), enabling attackers to manipulate the SQL query logic. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands on the Koha database. This can lead to unauthorized data disclosure, data modification, or deletion, severely impacting the confidentiality, integrity, and availability of the system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing the vulnerable script to untrusted users and consider implementing web application firewall rules to detect and block SQL injection attempts targeting the affected parameters.