CyberRota Analysis
AI-GeneratedAn SQL injection vulnerability in Koha affects versions up to 26.05.01, allowing authenticated staff with specific permissions to exploit the orderby request parameter in acqui/parcels.pl. This flaw enables attackers to extract sensitive data, including patron personally identifiable information (PII), staff bcrypt password hashes, and two-factor authentication secrets, through blind exploitation. Organizations using Koha, particularly those with staff access to the acquisition module, should prioritize immediate remediation to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.