CVE-2026-70370

Name of the Vulnerable Software and Affected Versions Koha (affected versions not specified)

Description The reports/catalogue stats.pl script builds dynamic SQL within the calculate() function by interpolating user-controlled Line and Column request parameters directly into identifier positions of the query, such as SELECT DISTINCTROW, GROUP BY, and ORDER BY, without whitelist validation. Additionally, if Line contains itemcallnumber and the cotedigits parameter is truthy, cotedigits is concatenated raw as the numeric argument of a LEFT() call. An authenticated staff user with reports module permissions can exploit this to inject arbitrary SQL and access any table reachable by the database user, including sensitive data such as password hashes, two-factor secrets, personal data in the borrowers table, api keys, and sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.