CyberRota Analysis
AI-GeneratedKoha's reports/acquisitions_stats.pl is vulnerable due to improper handling of user-controlled input in SQL queries, allowing authenticated staff users with reports module permissions to execute arbitrary SQL injections. This could lead to unauthorized access to sensitive data, including borrower information and password hashes. Organizations using Koha should prioritize patching this vulnerability to protect their databases from potential data breaches.
Original NVD Description
Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.