Vulnerability-Lookup

CVE-2026-6428 (GCVE-0-2026-6428)

Vulnerability from cvelistv5 – Published: 2026-06-13 16:34 – Updated: 2026-08-10 11:44

Title

Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

Summary

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

Severity

5.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-15 17:19 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

TuranSec redhat root

References

3 references

URL	Tags
https://bugs.koha-community.org/bugzilla3/show_bu…	issue-trackingvendor-advisory
https://bugs.koha-community.org/bugzilla3/attachm…	patchvendor-advisory
https://koha-community.org/security-releases/	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Koha Community	Koha	Affected: 0 , ≤ 22.11.38 (semver) Affected: 23.05.00 , ≤ 23.11.15 (semver) Affected: 24.05.00 , ≤ 24.11.16 (semver) Affected: 25.05.00 , ≤ 25.05.11 (semver) Affected: 25.11.00 , ≤ 25.11.05 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver)	guessed

Date Public

2026-06-13 16:34

Credits

Sanjar Tulkinov (Sanjarbiy)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6428",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T17:19:10.550362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T17:19:39.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/catalogue_out.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThanOrEqual": "22.11.38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "23.11.15",
              "status": "affected",
              "version": "23.05.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.11.16",
              "status": "affected",
              "version": "24.05.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "25.05.11",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "25.11.05",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjar Tulkinov (Sanjarbiy)"
        }
      ],
      "datePublic": "2026-06-13T16:34:10.326Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\u003c/p\u003e"
            }
          ],
          "value": "SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An authenticated staff user holding the Reports module permission can inject arbitrary SQL into the auxiliary $strsth2 statement built inside sub calculate when $tablename eq \u0027branches\u0027. Because the statement is sent to DBI without bound parameters, the attacker can read any row and column accessible to the Koha application database user, including the borrowers table (password hashes, two-factor authentication secrets, personally identifiable information), borrower_password_recovery, api_keys, sessions, and all circulation data. Error-based exfiltration is single-request (EXTRACTVALUE) and exposed through the DBI exception surfaced by the Reports CGI; time-based extraction and denial of service against the database remain possible even after the related information-disclosure issue (Koha bug 42366) is patched."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated staff user holding the Reports module flag sends a crafted GET request to /cgi-bin/koha/reports/catalogue_out.pl with Criteria=branchcode and a malicious Filter parameter to read arbitrary data from the Koha application database."
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:44:35.818Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "name": "Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameter",
          "tags": [
            "issue-tracking",
            "vendor-advisory"
          ],
          "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361"
        },
        {
          "name": "Bug 42361: Fix SQL injection in catalogue_out.pl (official patch)",
          "tags": [
            "patch",
            "vendor-advisory"
          ],
          "url": "https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539"
        },
        {
          "name": "Koha Community Security Releases",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://koha-community.org/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter",
      "x_author": "Sanjar Tulkinov (Sanjarbiy)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-6428",
    "datePublished": "2026-06-13T16:34:10.326Z",
    "dateReserved": "2026-04-16T12:58:10.800Z",
    "dateUpdated": "2026-08-10T11:44:35.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6428",
      "date": "2026-08-19",
      "epss": "0.00244",
      "percentile": "0.15912"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-6428\",\"sourceIdentifier\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"published\":\"2026-06-13T17:16:17.190\",\"lastModified\":\"2026-08-10T12:17:22.160\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\"},{\"lang\":\"es\",\"value\":\"Inyecci\u00f3n SQL en reports/catalogue_out.pl en Koha Community Koha hasta 22.11.37, 23.x, 24.x antes de 24.11.16, 25.05.x antes de 25.05.11, 25.11.x antes de 25.11.05, 26.05.x antes de 26.05.01, y 26.11.x antes de 26.11.00 permite a un usuario de personal autenticado con el indicador del m\u00f3dulo de Informes leer datos arbitrarios de la base de datos de la aplicaci\u00f3n Koha a trav\u00e9s del par\u00e1metro URL Filter cuando el par\u00e1metro Criteria coincide con /branchcode/.\\n\\nEl sumidero vulnerable en la subrutina calculate concatena el par\u00e1metro de solicitud Filter sin modificar directamente en una cl\u00e1usula LIKE de la sentencia auxiliar $strsth2 y lo ejecuta a trav\u00e9s de DBI sin par\u00e1metros vinculados:\\n\\nmy $f = @$filters[0];\\n$f =~ s/\\\\*/%/g;\\n$strsth2 .= \\\" AND $column LIKE \u0027$f\u0027 \\\";\\n\\nEsto permite la inyecci\u00f3n SQL basada en errores (por ejemplo, a trav\u00e9s de EXTRACTVALUE) y acceso de lectura completo a tablas sensibles incluyendo borrowers (hashes de contrase\u00f1as, secretos 2FA, PII), borrower_password_recovery, api_keys, y sessions.\\n\\nPrueba de concepto (basado en errores, solicitud \u00fanica):\\n\\nGET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1\u0026output=screen\u0026Limit=10\u0026Criteria=branchcode\u0026Filter=x\u0027+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+-\\nCookie: CGISESSID=\u003cLIBRARIAN_SESSION\u003e\\n\\nEl cuerpo de la respuesta contiene la excepci\u00f3n DBI filtrando la versi\u00f3n de MariaDB, el usuario de la base de datos, la IP del cliente, y el nombre de la base de datos, despu\u00e9s de lo cual se pueden paginar datos arbitrarios usando LIMIT n,1 / SUBSTRING(...).\\n\\nEl sumidero vulnerable fue introducido en el commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 parche\u00f3 la misma clase en archivos hermanos pero no generaliz\u00f3 la correcci\u00f3n a reports/catalogue_out.pl. Corregido en Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, y 26.11.00 reemplazando la concatenaci\u00f3n cruda con un marcador de posici\u00f3n parametrizado.\"}],\"affected\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"affectedData\":[{\"vendor\":\"Koha Community\",\"product\":\"Koha\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://koha-community.org/\",\"programFiles\":[\"reports/catalogue_out.pl\"],\"repo\":\"https://gitlab.com/koha-community/Koha\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"22.11.38\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"23.05.00\",\"lessThanOrEqual\":\"23.11.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"24.05.00\",\"lessThanOrEqual\":\"24.11.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"25.05.00\",\"lessThanOrEqual\":\"25.05.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"25.11.00\",\"lessThanOrEqual\":\"25.11.05\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"26.05.00\",\"lessThanOrEqual\":\"26.05.01\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber\",\"baseScore\":5.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"CONCENTRATED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"AMBER\"}}],\"cvssMetricV31\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}],\"cvssMetricV2\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:N/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":7.8,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-15T17:19:10.550362Z\",\"id\":\"CVE-2026-6428\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"},{\"url\":\"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"},{\"url\":\"https://koha-community.org/security-releases/\",\"source\":\"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-6428\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-15T17:19:10.550362Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-15T17:19:27.650Z\"}}], \"cna\": {\"title\": \"Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Sanjar Tulkinov (Sanjarbiy)\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An authenticated staff user holding the Reports module permission can inject arbitrary SQL into the auxiliary $strsth2 statement built inside sub calculate when $tablename eq \u0027branches\u0027. Because the statement is sent to DBI without bound parameters, the attacker can read any row and column accessible to the Koha application database user, including the borrowers table (password hashes, two-factor authentication secrets, personally identifiable information), borrower_password_recovery, api_keys, sessions, and all circulation data. Error-based exfiltration is single-request (EXTRACTVALUE) and exposed through the DBI exception surfaced by the Reports CGI; time-based extraction and denial of service against the database remain possible even after the related information-disclosure issue (Koha bug 42366) is patched.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.6, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber\", \"exploitMaturity\": \"PROOF_OF_CONCEPT\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"An authenticated staff user holding the Reports module flag sends a crafted GET request to /cgi-bin/koha/reports/catalogue_out.pl with Criteria=branchcode and a malicious Filter parameter to read arbitrary data from the Koha application database.\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"vectorString\": \"AV:N/AC:L/Au:S/C:C/I:N/A:P\", \"authentication\": \"SINGLE\", \"integrityImpact\": \"NONE\", \"accessComplexity\": \"LOW\", \"availabilityImpact\": \"PARTIAL\", \"confidentialityImpact\": \"COMPLETE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://gitlab.com/koha-community/Koha\", \"vendor\": \"Koha Community\", \"product\": \"Koha\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"22.11.38\"}, {\"status\": \"affected\", \"version\": \"23.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"23.11.15\"}, {\"status\": \"affected\", \"version\": \"24.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"24.11.16\"}, {\"status\": \"affected\", \"version\": \"25.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"25.05.11\"}, {\"status\": \"affected\", \"version\": \"25.11.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"25.11.05\"}, {\"status\": \"affected\", \"version\": \"26.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"26.05.01\"}], \"programFiles\": [\"reports/catalogue_out.pl\"], \"collectionURL\": \"https://koha-community.org/\", \"defaultStatus\": \"unaffected\"}], \"x_author\": \"Sanjar Tulkinov (Sanjarbiy)\", \"datePublic\": \"2026-06-13T16:34:10.326Z\", \"references\": [{\"url\": \"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361\", \"name\": \"Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameter\", \"tags\": [\"issue-tracking\", \"vendor-advisory\"]}, {\"url\": \"https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539\", \"name\": \"Bug 42361: Fix SQL injection in catalogue_out.pl (official patch)\", \"tags\": [\"patch\", \"vendor-advisory\"]}, {\"url\": \"https://koha-community.org/security-releases/\", \"name\": \"Koha Community Security Releases\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"shortName\": \"TuranSec\", \"dateUpdated\": \"2026-08-10T11:44:35.818Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-6428\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T11:44:35.818Z\", \"dateReserved\": \"2026-04-16T12:58:10.800Z\", \"assignerOrgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"datePublished\": \"2026-06-13T16:34:10.326Z\", \"assignerShortName\": \"TuranSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-6428

Vulnerability from fkie_nvd - Published: 2026-06-13 17:16 - Updated: 2026-08-10 12:17

Severity

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Summary

References

	URL	Tags
	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539
	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361
	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	https://koha-community.org/security-releases/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/catalogue_out.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThanOrEqual": "22.11.38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "23.11.15",
              "status": "affected",
              "version": "23.05.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.11.16",
              "status": "affected",
              "version": "24.05.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "25.05.11",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "25.11.05",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/."
    },
    {
      "lang": "es",
      "value": "Inyecci\u00f3n SQL en reports/catalogue_out.pl en Koha Community Koha hasta 22.11.37, 23.x, 24.x antes de 24.11.16, 25.05.x antes de 25.05.11, 25.11.x antes de 25.11.05, 26.05.x antes de 26.05.01, y 26.11.x antes de 26.11.00 permite a un usuario de personal autenticado con el indicador del m\u00f3dulo de Informes leer datos arbitrarios de la base de datos de la aplicaci\u00f3n Koha a trav\u00e9s del par\u00e1metro URL Filter cuando el par\u00e1metro Criteria coincide con /branchcode/.\n\nEl sumidero vulnerable en la subrutina calculate concatena el par\u00e1metro de solicitud Filter sin modificar directamente en una cl\u00e1usula LIKE de la sentencia auxiliar $strsth2 y lo ejecuta a trav\u00e9s de DBI sin par\u00e1metros vinculados:\n\nmy $f = @$filters[0];\n$f =~ s/\\*/%/g;\n$strsth2 .= \" AND $column LIKE \u0027$f\u0027 \";\n\nEsto permite la inyecci\u00f3n SQL basada en errores (por ejemplo, a trav\u00e9s de EXTRACTVALUE) y acceso de lectura completo a tablas sensibles incluyendo borrowers (hashes de contrase\u00f1as, secretos 2FA, PII), borrower_password_recovery, api_keys, y sessions.\n\nPrueba de concepto (basado en errores, solicitud \u00fanica):\n\nGET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1\u0026output=screen\u0026Limit=10\u0026Criteria=branchcode\u0026Filter=x\u0027+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+-\nCookie: CGISESSID=\u003cLIBRARIAN_SESSION\u003e\n\nEl cuerpo de la respuesta contiene la excepci\u00f3n DBI filtrando la versi\u00f3n de MariaDB, el usuario de la base de datos, la IP del cliente, y el nombre de la base de datos, despu\u00e9s de lo cual se pueden paginar datos arbitrarios usando LIMIT n,1 / SUBSTRING(...).\n\nEl sumidero vulnerable fue introducido en el commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 parche\u00f3 la misma clase en archivos hermanos pero no generaliz\u00f3 la correcci\u00f3n a reports/catalogue_out.pl. Corregido en Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, y 26.11.00 reemplazando la concatenaci\u00f3n cruda con un marcador de posici\u00f3n parametrizado."
    }
  ],
  "id": "CVE-2026-6428",
  "lastModified": "2026-08-10T12:17:22.160",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 7.8,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.6,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "AMBER",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-6428",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-15T17:19:10.550362Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-13T17:16:17.190",
  "references": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539"
    },
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361"
    },
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://koha-community.org/security-releases/"
    }
  ],
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary"
    }
  ]
}

GHSA-6CMJ-32GF-5R49

Vulnerability from github – Published: 2026-06-13 18:30 – Updated: 2026-06-13 18:30

Details

The vulnerable sink in sub calculate concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters:

my $f = @$filters[0]; $f =~ s/*/%/g; $strsth2 .= " AND $column LIKE '$f' ";

This enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions.

Proof of concept (error-based, single request):

GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&Limit=10&Criteria=branchcode&Filter=x'+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+- Cookie: CGISESSID=

The response body contains the DBI exception leaking the MariaDB version, database user, client IP, and database name, after which arbitrary data can be paged out using LIMIT n,1 / SUBSTRING(...).

The vulnerable sink was introduced in commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 patched the same class in sibling files but did not generalise the fix to reports/catalogue_out.pl. Fixed in Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00 by replacing the raw concatenation with a parameterised placeholder.

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

5.6 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-6428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-13T17:16:17Z",
    "severity": "MODERATE"
  },
  "details": "SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\n\n\n\nThe vulnerable sink in sub calculate concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters:\n\n\n\nmy $f = @$filters[0];\n$f =~ s/\\*/%/g;\n$strsth2 .= \" AND $column LIKE \u0027$f\u0027 \";\n\n\n\nThis enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions.\n\n\n\nProof of concept (error-based, single request):\n\n\n\nGET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1\u0026output=screen\u0026Limit=10\u0026Criteria=branchcode\u0026Filter=x\u0027+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+-\nCookie: CGISESSID=\u003cLIBRARIAN_SESSION\u003e\n\n\n\nThe response body contains the DBI exception leaking the MariaDB version, database user, client IP, and database name, after which arbitrary data can be paged out using LIMIT n,1 / SUBSTRING(...).\n\n\n\nThe vulnerable sink was introduced in commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 patched the same class in sibling files but did not generalise the fix to reports/catalogue_out.pl. Fixed in Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00 by replacing the raw concatenation with a parameterised placeholder.",
  "id": "GHSA-6cmj-32gf-5r49",
  "modified": "2026-06-13T18:30:24Z",
  "published": "2026-06-13T18:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6428"
    },
    {
      "type": "WEB",
      "url": "https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539"
    },
    {
      "type": "WEB",
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361"
    },
    {
      "type": "WEB",
      "url": "https://koha-community.org/security-releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-6428 (GCVE-0-2026-6428)

FKIE_CVE-2026-6428

GHSA-6CMJ-32GF-5R49

Tags

Sightings

Nomenclature