CVE-2026-6428

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

CVSS v3 7.6 HIGH
CVSS v2.0 7.5 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:N/A:P

Exploitability : 8.0 / Impact : 7.8

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361
https://koha-community.org/security-releases/

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-13 17:16

Updated : 2026-08-10 12:17

NVD link : CVE-2026-6428

Mitre link : CVE-2026-6428

CVE.ORG link : CVE-2026-6428

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-6428", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6428", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:19:10.550362Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 7.8, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.6, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"repo": "https://gitlab.com/koha-community/Koha", "vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "22.11.38"}, {"status": "affected", "version": "23.05.00", "versionType": "semver", "lessThanOrEqual": "23.11.15"}, {"status": "affected", "version": "24.05.00", "versionType": "semver", "lessThanOrEqual": "24.11.16"}, {"status": "affected", "version": "25.05.00", "versionType": "semver", "lessThanOrEqual": "25.05.11"}, {"status": "affected", "version": "25.11.00", "versionType": "semver", "lessThanOrEqual": "25.11.05"}, {"status": "affected", "version": "26.05.00", "versionType": "semver", "lessThanOrEqual": "26.05.01"}], "programFiles": ["reports/catalogue_out.pl"], "collectionURL": "https://koha-community.org/", "defaultStatus": "unaffected"}]}], "published": "2026-06-13T17:16:17.190", "references": [{"url": "https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://koha-community.org/security-releases/", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/."}, {"lang": "es", "value": "Inyecci\u00f3n SQL en reports/catalogue_out.pl en Koha Community Koha hasta 22.11.37, 23.x, 24.x antes de 24.11.16, 25.05.x antes de 25.05.11, 25.11.x antes de 25.11.05, 26.05.x antes de 26.05.01, y 26.11.x antes de 26.11.00 permite a un usuario de personal autenticado con el indicador del m\u00f3dulo de Informes leer datos arbitrarios de la base de datos de la aplicaci\u00f3n Koha a trav\u00e9s del par\u00e1metro URL Filter cuando el par\u00e1metro Criteria coincide con /branchcode/.\n\nEl sumidero vulnerable en la subrutina calculate concatena el par\u00e1metro de solicitud Filter sin modificar directamente en una cl\u00e1usula LIKE de la sentencia auxiliar $strsth2 y lo ejecuta a trav\u00e9s de DBI sin par\u00e1metros vinculados:\n\nmy $f = @$filters[0];\n$f =~ s/\\*/%/g;\n$strsth2 .= \" AND $column LIKE '$f' \";\n\nEsto permite la inyecci\u00f3n SQL basada en errores (por ejemplo, a trav\u00e9s de EXTRACTVALUE) y acceso de lectura completo a tablas sensibles incluyendo borrowers (hashes de contrase\u00f1as, secretos 2FA, PII), borrower_password_recovery, api_keys, y sessions.\n\nPrueba de concepto (basado en errores, solicitud \u00fanica):\n\nGET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&Limit=10&Criteria=branchcode&Filter=x'+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+-\nCookie: CGISESSID=<LIBRARIAN_SESSION>\n\nEl cuerpo de la respuesta contiene la excepci\u00f3n DBI filtrando la versi\u00f3n de MariaDB, el usuario de la base de datos, la IP del cliente, y el nombre de la base de datos, despu\u00e9s de lo cual se pueden paginar datos arbitrarios usando LIMIT n,1 / SUBSTRING(...).\n\nEl sumidero vulnerable fue introducido en el commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 parche\u00f3 la misma clase en archivos hermanos pero no generaliz\u00f3 la correcci\u00f3n a reports/catalogue_out.pl. Corregido en Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, y 26.11.00 reemplazando la concatenaci\u00f3n cruda con un marcador de posici\u00f3n parametrizado."}], "lastModified": "2026-08-10T12:17:22.160", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}