Koha vulnerabilities

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL, and Criteria is never validated against an allow-list. An authenticated staff user with the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers, api_keys, and sessions.

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The jobid parameter passed to C4::Scheduler::remove_at_job is not validated, and Schedule::At::remove substitutes it into an atrm command string without quoting or escaping, executing it through a single-argument system() call that invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can execute arbitrary OS commands as the Koha application user.

A Remote Code Execution vulnerability in Koha results from the lack of proper validation of a user-supplied string before passing it to the eval function in the web service listening on TCP port 8081 by default. An authenticated attacker can exploit this vulnerability to execute code in the context of the service account.

Koha before versions 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.

Stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with borrowers => edit_borrowers permission can cause time-based denial of service by storing a SQL payload in a patron lang field, which executes when an issue slip is printed.

An SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

Stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with tools => label_creator permission can execute arbitrary SQL via the image_name field of a patron card layout, allowing reading the entire database including patron PII and staff bcrypt password hashes.

A stored SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The value is stored verbatim and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. The injection allows reading the entire Koha database including patron PII and staff bcrypt password hashes.

Koha's guided report builder reads CGI parameters and concatenates them directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared statements, an explicit allowlist is required but missing.

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

Vulnerability in Koha's reports/catalogue_stats.pl where dynamic SQL is built by interpolating user-controlled Line and Column parameters directly into identifier positions of the query without whitelist validation.

Vulnerability in Koha's reports/acquisitions_stats.pl where the per-cell statistics query is built by interpolating user-controlled Filter parameters directly into WHERE fragments covering multiple fields.

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability in the Z39.50/SRU server configuration. Authenticated attackers can scan internal networks and identify running services by analyzing server response times.

Koha version 25.11 and earlier is vulnerable to XSS via the file upload function in the Invoice module. An attacker can remotely execute arbitrary JavaScript code.

Authenticated SQL Injection vulnerability in Koha staff interface at /cgi-bin/koha/suggestion/suggestion.pl due to improper validation of the displayby parameter. It may lead to full compromise of the backend database.