Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105107— Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Quick assessment

Affected
Koha Community Koha
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Koha 在“最受欢迎图书报告”模块中存在 SQL 注入漏洞。reports/cat_issues_top.pl 脚本中的 calculate 函数将用户可控的 Criteria（条件）、Filter（筛选）和 Limit（限制）请求参数直接拼接到动态 SQL 查询中。其中，Criteria 参数仅经过前缀规范化处理，且未通过允许名单进行验证，因此其值被原样插入到标识符位置（如 SELECT DISTINCTROW、GROUP BY、ORDER BY 以及核心计算查询中）。Filter 参数以未过滤的形式直接拼接进

CVSS 7.6 · High EPSS 0.28% · P19

Affected Version Matrix 5

VendorProduct Version RangeStatus
Koha Community Koha < 24.11.00 affected
24.11.00< 24.11.19 affected
25.05.00< 25.05.14 affected
25.11.00< 25.11.08 affected
26.05.00< 26.05.03 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105107

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
Source: CVE Program / CVE List V5
Vulnerability Description
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Koha Community Koha 0 ~ 24.11.00 -

II. Public POCs for CVE-2026-105107

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105107

请登录查看更多情报信息。

Other References for CVE-2026-105107 (4)

IV. Related Vulnerabilities

Same product: Koha
Same vendor: Koha Community
Same weakness: CWE-89

V. Comments for CVE-2026-105107

No comments yet

Leave a comment