CVE-2026-70371

Name of the Vulnerable Software and Affected Versions Koha (affected versions not specified)

Description The reports/issues avg stats.pl script builds dynamic SQL within the calculate() function by concatenating user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against a whitelist and are placed directly into identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY. Additionally, each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments without using bound parameters. An authenticated staff user with reports module permissions can exploit this to inject arbitrary SQL and access any table reachable by the database user, including sensitive data such as password hashes, two-factor secrets, personal data in the borrowers table, api keys, and sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.