CVE-2026-31844

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31844", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-03-09T18:20:23.398Z", "datePublished": "2026-03-11T06:34:14.869Z", "dateUpdated": "2026-08-10T11:43:33.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:43:33.492Z"}, "title": "Authenticated SQL Injection in Koha displayby parameter of suggestion.pl", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 \u2014 SQL Injection"}]}], "affected": [{"vendor": "Koha Community", "product": "Koha", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "24.11.0", "versionType": "semver", "lessThanOrEqual": "24.11.12"}, {"status": "affected", "version": "25.05.0", "versionType": "semver", "lessThanOrEqual": "25.05.07"}, {"status": "affected", "version": "25.11.0", "versionType": "semver", "lessThanOrEqual": "25.11.01"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593", "tags": ["issue-tracking"]}, {"url": "https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/", "tags": ["vendor-advisory"]}, {"url": "https://koha-community.org/koha-25-11-01-released/", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV2_0": {"version": "2.0", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "credits": [{"lang": "en", "value": "Raximov Shukrulloh (Mothra)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram"}, "datePublic": "2026-03-11T06:34:14.869Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:01:54.335981Z", "id": "CVE-2026-31844", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:02:52.043Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31844", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T14:01:54.335981Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:02:48.515Z"}}], "cna": {"tags": ["x_open-source"], "title": "Authenticated SQL Injection in Koha displayby parameter of suggestion.pl", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Raximov Shukrulloh (Mothra)"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 \u2014 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV2_0": {"version": "2.0", "baseScore": 9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "24.11.0", "versionType": "semver", "lessThanOrEqual": "24.11.12"}, {"status": "affected", "version": "25.05.0", "versionType": "semver", "lessThanOrEqual": "25.05.07"}, {"status": "affected", "version": "25.11.0", "versionType": "semver", "lessThanOrEqual": "25.11.01"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "datePublic": "2026-03-11T06:34:14.869Z", "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593", "tags": ["issue-tracking"]}, {"url": "https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/", "tags": ["vendor-advisory"]}, {"url": "https://koha-community.org/koha-25-11-01-released/", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram"}, "descriptions": [{"lang": "en", "value": "An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.", "supportingMedia": [{"type": "text/html", "value": "<p>An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:43:33.492Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31844", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:43:33.492Z", "dateReserved": "2026-03-09T18:20:23.398Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-03-11T06:34:14.869Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Koha", "vendor": "Koha Community", "versions": [{"lessThanOrEqual": "24.11.12", "status": "affected", "version": "24.11.0", "versionType": "semver"}, {"lessThanOrEqual": "25.05.07", "status": "affected", "version": "25.05.0", "versionType": "semver"}, {"lessThanOrEqual": "25.11.01", "status": "affected", "version": "25.11.0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA048D50-9FD2-4698-A3B8-4D94822EEB51", "versionEndExcluding": "24.11.12", "versionStartIncluding": "24.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "matchCriteriaId": "98736DE8-E714-4616-9821-A8D2469D9D67", "versionEndExcluding": "25.05.07", "versionStartIncluding": "25.05.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:koha:koha:25.11.00:*:*:*:*:*:*:*", "matchCriteriaId": "BB09F313-B930-48A5-8FB7-5A0CC00EA3AF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n SQL autenticada (CWE-89) en la interfaz de personal de Koha, en el endpoint /cgi-bin/koha/suggestion/suggestion.pl, debido a una validaci\u00f3n incorrecta del par\u00e1metro displayby utilizado por la funcionalidad GetDistinctValues. Un usuario de personal con bajos privilegios puede inyectar consultas SQL arbitrarias a trav\u00e9s de solicitudes manipuladas a este par\u00e1metro, permitiendo la ejecuci\u00f3n de sentencias SQL no intencionadas y la exposici\u00f3n de informaci\u00f3n sensible de la base de datos. La explotaci\u00f3n exitosa puede llevar a un compromiso total de la base de datos de backend, incluyendo la divulgaci\u00f3n o modificaci\u00f3n de los datos almacenados."}], "id": "CVE-2026-31844", "lastModified": "2026-08-10T12:17:14.883", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31844", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:01:54.335981Z", "version": "2.0.3"}}]}, "published": "2026-03-11T07:16:43.900", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "tags": ["Issue Tracking"], "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "tags": ["Not Applicable"], "url": "https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "tags": ["Release Notes"], "url": "https://koha-community.org/koha-25-11-01-released/"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[24.11.0,24.11.12)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[25.05.0,25.05.07)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[25.11.0,25.11.01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Koha", "source": "cna", "vendor": "Koha Community"}, "product": "koha", "vendor": "koha-community"}], "created": "2026-03-12T10:06:21.862739+00:00", "updated": "2026-08-10T23:45:04.657107+00:00", "vendors": ["koha-community", "koha-community$PRODUCT$koha"]}