The guided report builder in Koha Community Koha (reports/guided_reports.pl) reads the 'order_by' CGI parameter and dynamically constructs an SQL ORDER BY clause by concatenating user-supplied values without validation or an allowlist. Since ORDER BY columns cannot be safely parameterized in prepared statements, the lack of validation enables SQL injection. Staff accounts with low-privilege permissions (create_reports or execute_reports) can exploit this to perform time-based blind SQL injection against the Koha database, which contains patron personally identifiable information and staff/LDAP credentials. The vulnerability is tracked as CVE-2026-71288 with a CVSS 3.1 score of 8.8 (high severity). No patch or official remediation is currently documented.

Exploitation of this vulnerability allows an attacker with low-privilege staff access to execute arbitrary SQL commands via time-based blind SQL injection. This can lead to unauthorized disclosure, modification, or deletion of sensitive data including patron PII and staff credentials, potentially compromising confidentiality, integrity, and availability of the Koha database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or review staff permissions related to create_reports and execute_reports to trusted personnel only. Monitor for unusual report-building activity and consider additional application-layer controls to validate or restrict input parameters used in SQL queries.