CVE-2026-70369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70369", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-04T07:13:07.992Z", "datePublished": "2026-08-04T12:59:55.938Z", "dateUpdated": "2026-08-10T11:44:38.356Z"}, "containers": {"cna": {"title": "Koha - SQL Injection in reports/acquisitions_stats.pl", "descriptions": [{"lang": "en", "value": "Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 SQL Injection", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Koha Community", "product": "Koha", "collectionURL": "https://koha-community.org/", "repo": "https://gitlab.com/koha-community/Koha", "programFiles": ["reports/acquisitions_stats.pl"], "versions": [{"version": "0", "versionType": "semver", "status": "affected", "lessThanOrEqual": "24.11.17"}, {"version": "25.05.00", "versionType": "semver", "status": "affected", "lessThanOrEqual": "25.05.12"}, {"version": "25.11.00", "versionType": "semver", "status": "affected", "lessThanOrEqual": "25.11.06"}, {"version": "26.05.00", "versionType": "semver", "status": "affected", "lessThanOrEqual": "26.05.01"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360", "tags": ["third-party-advisory"]}, {"url": "https://koha-community.org/koha-25-05-12-released/", "tags": ["third-party-advisory"]}, {"url": "https://download.koha-community.org/koha-25.05.12.tar.gz", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Sanjar Tulkinov Anvar o'g'li", "type": "finder"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:38.356Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-04T12:59:55.938Z"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T17:20:31.267167Z", "id": "CVE-2026-70369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:20:36.590Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-70369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T17:20:31.267167Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:20:27.951Z"}}], "cna": {"title": "Koha - SQL Injection in reports/acquisitions_stats.pl", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sanjar Tulkinov Anvar o'g'li"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://gitlab.com/koha-community/Koha", "vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.11.17"}, {"status": "affected", "version": "25.05.00", "versionType": "semver", "lessThanOrEqual": "25.05.12"}, {"status": "affected", "version": "25.11.00", "versionType": "semver", "lessThanOrEqual": "25.11.06"}, {"status": "affected", "version": "26.05.00", "versionType": "semver", "lessThanOrEqual": "26.05.01"}], "programFiles": ["reports/acquisitions_stats.pl"], "collectionURL": "https://koha-community.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-04T12:59:55.938Z", "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360", "tags": ["third-party-advisory"]}, {"url": "https://koha-community.org/koha-25-05-12-released/", "tags": ["third-party-advisory"]}, {"url": "https://download.koha-community.org/koha-25.05.12.tar.gz", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.", "supportingMedia": [{"type": "text/html", "value": "<p>Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 SQL Injection"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:38.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70369", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:44:38.356Z", "dateReserved": "2026-08-04T07:13:07.992Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-04T12:59:55.938Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://koha-community.org/", "defaultStatus": "unaffected", "product": "Koha", "programFiles": ["reports/acquisitions_stats.pl"], "repo": "https://gitlab.com/koha-community/Koha", "vendor": "Koha Community", "versions": [{"lessThanOrEqual": "24.11.17", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "25.05.12", "status": "affected", "version": "25.05.00", "versionType": "semver"}, {"lessThanOrEqual": "25.11.06", "status": "affected", "version": "25.11.00", "versionType": "semver"}, {"lessThanOrEqual": "26.05.01", "status": "affected", "version": "26.05.00", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2."}, {"lang": "es", "value": "El script reports/acquisitions_stats.pl de Koha construye su consulta de estad\u00edsticas por celda en la subrutina calculate interpolando los par\u00e1metros de solicitud de filtro controlados por el usuario directamente en fragmentos WHERE que cubren aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1 y aqorders.sort2. La sentencia se prepara y ejecuta sin par\u00e1metros vinculados. Un usuario de personal autenticado que posee el permiso del m\u00f3dulo de informes puede inyectar SQL arbitrario y leer cualquier tabla accesible por el usuario de la base de datos de Koha, incluyendo borrowers (hashes de contrase\u00f1as, secretos de doble factor, datos personales), borrower_password_recovery, api_keys y sessions."}], "id": "CVE-2026-70369", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70369", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T17:20:31.267167Z", "version": "2.0.3"}}]}, "published": "2026-08-04T13:18:57.680", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://koha-community.org/koha-25-05-12-released/"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,24.11.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.05.00,25.05.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.11.00,25.11.06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.05.00,26.05.01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Koha", "source": "cna", "vendor": "Koha Community"}, "product": "koha", "vendor": "koha-community"}], "created": "2026-08-04T14:45:03.073355+00:00", "updated": "2026-08-10T23:15:05.952180+00:00", "vendors": ["koha-community", "koha-community$PRODUCT$koha"]}