CVE-2026-70372

Name of the Vulnerable Software and Affected Versions Koha (affected versions not specified)

Description The reports/bor issues top.pl script builds dynamic SQL within the calculate() function by concatenating user-controlled request parameters directly into the query string. The Criteria parameter is not whitelisted and is inserted into identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY. Additionally, Filter values are concatenated raw into LIKE, BETWEEN, and comparison fragments, while the Limit parameter is appended raw to a LIMIT clause. An authenticated staff user with reports module permissions can perform SQL injection to read any table accessible by the database user, including sensitive data such as password hashes, two-factor secrets, personal data from the borrowers table, api keys, and sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.