CyberRota Analysis
AI-GeneratedKoha's reports module is vulnerable to SQL injection due to improper handling of user-controlled parameters in the bor_issues_top.pl script, allowing authenticated staff users to manipulate SQL queries. This vulnerability can lead to unauthorized access to sensitive data, including borrower information and authentication secrets. Organizations using Koha, particularly those with staff members who have access to the reports module, should prioritize addressing this issue to mitigate potential data breaches.
Original NVD Description
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.