Koha Community's guided report builder script (reports/guided_reports.pl) reads CGI parameters and dynamically constructs an SQL ORDER BY clause by concatenating these parameters directly without any allowlist or validation. Since ORDER BY columns cannot be parameterized using prepared statements, the absence of an explicit allowlist leads to a SQL injection vulnerability (CWE-89). This flaw allows an attacker with low privileges to execute arbitrary SQL commands, impacting confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands via the ORDER BY clause in the guided report builder. This can lead to full compromise of the system's confidentiality, integrity, and availability, including unauthorized data access, data modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is released, restrict access to the guided report builder functionality to trusted users only and monitor for suspicious activity related to report generation. Avoid exposing this functionality to untrusted users.