CVE-2026-31844

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593	Issue Tracking
https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/	Not Applicable
https://koha-community.org/koha-25-11-01-released/	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:koha:koha::::::::
	cpe:2.3:a:koha:koha::::::::
	cpe:2.3:a:koha:koha:25.11.00:::::::*

History

No history.

Information

Published : 2026-03-11 07:16

Updated : 2026-08-10 12:17

NVD link : CVE-2026-31844

Mitre link : CVE-2026-31844

CVE.ORG link : CVE-2026-31844

JSON object : View

Products Affected

koha

koha

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-31844", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31844", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T14:01:54.335981Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "24.11.0", "versionType": "semver", "lessThanOrEqual": "24.11.12"}, {"status": "affected", "version": "25.05.0", "versionType": "semver", "lessThanOrEqual": "25.05.07"}, {"status": "affected", "version": "25.11.0", "versionType": "semver", "lessThanOrEqual": "25.11.01"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-03-11T07:16:43.900", "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593", "tags": ["Issue Tracking"], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/", "tags": ["Not Applicable"], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://koha-community.org/koha-25-11-01-released/", "tags": ["Release Notes"], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n SQL autenticada (CWE-89) en la interfaz de personal de Koha, en el endpoint /cgi-bin/koha/suggestion/suggestion.pl, debido a una validaci\u00f3n incorrecta del par\u00e1metro displayby utilizado por la funcionalidad GetDistinctValues. Un usuario de personal con bajos privilegios puede inyectar consultas SQL arbitrarias a trav\u00e9s de solicitudes manipuladas a este par\u00e1metro, permitiendo la ejecuci\u00f3n de sentencias SQL no intencionadas y la exposici\u00f3n de informaci\u00f3n sensible de la base de datos. La explotaci\u00f3n exitosa puede llevar a un compromiso total de la base de datos de backend, incluyendo la divulgaci\u00f3n o modificaci\u00f3n de los datos almacenados."}], "lastModified": "2026-08-10T12:17:14.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA048D50-9FD2-4698-A3B8-4D94822EEB51", "versionEndExcluding": "24.11.12", "versionStartIncluding": "24.11.0"}, {"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98736DE8-E714-4616-9821-A8D2469D9D67", "versionEndExcluding": "25.05.07", "versionStartIncluding": "25.05.0"}, {"criteria": "cpe:2.3:a:koha:koha:25.11.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB09F313-B930-48A5-8FB7-5A0CC00EA3AF"}], "operator": "OR"}]}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}