CyberRota Analysis
AI-GeneratedThe vulnerability exists in Koha's guided report builder, where unsanitized user input from the `order_by` and dynamically-named parameters is directly concatenated into an SQL ORDER BY clause, allowing for time-based blind SQL injection. This flaw can be exploited by low-privilege staff accounts to manipulate queries, potentially exposing sensitive patron information and staff credentials stored in the database. Organizations using Koha, particularly libraries with non-admin staff accounts, should prioritize patching this vulnerability to protect against unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.