Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
Summary
| CVE | CVE-2026-72610 |
|---|---|
| State | PUBLISHED |
| Assigner | TuranSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-11 12:17:44 UTC |
| Updated | 2026-08-11 13:19:05 UTC |
| Description | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->search_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows. |
Risk And Classification
Primary CVSS: v3.1 4.3 MEDIUM from 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Problem Types: CWE-89 | CWE-89 CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | Secondary | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | CNA | CVSS | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
LowCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Koha Community | Koha | affected 24.11.18 custom | Not specified |
| CNA | Koha Community | Koha | affected 25.05.0 25.05.13 custom | Not specified |
| CNA | Koha Community | Koha | affected 25.11.0 25.11.07 custom | Not specified |
| CNA | Koha Community | Koha | affected 26.05.0 26.05.02 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugs.koha-community.org/bugzilla3/show_bug.cgi | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | bugs.koha-community.org | |
| koha-community.org | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | koha-community.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sanjar Tulkinov Anvar ogʻli ([email protected]) (en)
There are currently no legacy QID mappings associated with this CVE.