Koha - SQL Injection in reports/acquisitions_stats.pl
Summary
| CVE | CVE-2026-70369 |
|---|---|
| State | PUBLISHED |
| Assigner | TuranSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-04 13:18:57 UTC |
| Updated | 2026-08-26 17:36:16 UTC |
| Description | Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.003060000 probability, percentile 0.227990000 (date 2026-08-27)
Problem Types: CWE-89 | CWE-89 CWE-89 SQL Injection
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | DECLARED | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Koha Community | Koha | affected 24.11.17 semver | Not specified |
| CNA | Koha Community | Koha | affected 25.05.00 25.05.12 semver | Not specified |
| CNA | Koha Community | Koha | affected 25.11.00 25.11.06 semver | Not specified |
| CNA | Koha Community | Koha | affected 26.05.00 26.05.01 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| koha-community.org/koha-25-05-12-released | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | koha-community.org | |
| download.koha-community.org/koha-25.05.12.tar.gz | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | download.koha-community.org | |
| bugs.koha-community.org/bugzilla3/show_bug.cgi | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | bugs.koha-community.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sanjar Tulkinov Anvar o'g'li (en)
There are currently no legacy QID mappings associated with this CVE.