Koha - SQL Injection in reports/bor_issues_top.pl
Summary
| CVE | CVE-2026-70372 |
|---|---|
| State | PUBLISHED |
| Assigner | TuranSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-04 13:18:58 UTC |
| Updated | 2026-08-10 12:17:22 UTC |
| Description | Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.003060000 probability, percentile 0.229530000 (date 2026-08-10)
Problem Types: CWE-89 | CWE-89 CWE-89 SQL Injection
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | DECLARED | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Koha Community | Koha | affected 24.11.17 semver | Not specified |
| CNA | Koha Community | Koha | affected 25.05.00 25.05.12 semver | Not specified |
| CNA | Koha Community | Koha | affected 25.11.00 25.11.06 semver | Not specified |
| CNA | Koha Community | Koha | affected 26.05.00 26.05.01 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| koha-community.org/koha-25-05-12-released | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | koha-community.org | |
| bugs.koha-community.org/bugzilla3/show_bug.cgi | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | bugs.koha-community.org | |
| download.koha-community.org/koha-25.05.12.tar.gz | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | download.koha-community.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sanjar Tulkinov Anvar o'g'li (en)
There are currently no legacy QID mappings associated with this CVE.