CVE-2026-70372

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70372", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-04T07:13:07.992Z", "datePublished": "2026-08-04T13:00:12.836Z", "dateUpdated": "2026-08-10T11:44:44.671Z"}, "containers": {"cna": {"title": "Koha - SQL Injection in reports/bor_issues_top.pl", "descriptions": [{"lang": "en", "value": "Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 SQL Injection", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Koha Community", "product": "Koha", "collectionURL": "https://koha-community.org/", "repo": "https://gitlab.com/koha-community/Koha", "programFiles": ["reports/bor_issues_top.pl"], "versions": [{"version": "0", "versionType": "semver", "status": "affected", "lessThanOrEqual": "24.11.17"}, {"version": "25.05.00", "versionType": "semver", "status": "affected", "lessThanOrEqual": "25.05.12"}, {"version": "25.11.00", "versionType": "semver", "status": "affected", "lessThanOrEqual": "25.11.06"}, {"version": "26.05.00", "versionType": "semver", "status": "affected", "lessThanOrEqual": "26.05.01"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369", "tags": ["third-party-advisory"]}, {"url": "https://koha-community.org/koha-25-05-12-released/", "tags": ["third-party-advisory"]}, {"url": "https://download.koha-community.org/koha-25.05.12.tar.gz", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Sanjar Tulkinov Anvar o'g'li", "type": "finder"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:44.671Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-04T13:00:12.836Z"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T17:22:31.575799Z", "id": "CVE-2026-70372", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:23:04.169Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-70372", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T17:22:31.575799Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:23:00.953Z"}}], "cna": {"title": "Koha - SQL Injection in reports/bor_issues_top.pl", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sanjar Tulkinov Anvar o'g'li"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://gitlab.com/koha-community/Koha", "vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.11.17"}, {"status": "affected", "version": "25.05.00", "versionType": "semver", "lessThanOrEqual": "25.05.12"}, {"status": "affected", "version": "25.11.00", "versionType": "semver", "lessThanOrEqual": "25.11.06"}, {"status": "affected", "version": "26.05.00", "versionType": "semver", "lessThanOrEqual": "26.05.01"}], "programFiles": ["reports/bor_issues_top.pl"], "collectionURL": "https://koha-community.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-04T13:00:12.836Z", "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369", "tags": ["third-party-advisory"]}, {"url": "https://koha-community.org/koha-25-05-12-released/", "tags": ["third-party-advisory"]}, {"url": "https://download.koha-community.org/koha-25.05.12.tar.gz", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.", "supportingMedia": [{"type": "text/html", "value": "<p>Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 SQL Injection"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:44.671Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70372", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:44:44.671Z", "dateReserved": "2026-08-04T07:13:07.992Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-04T13:00:12.836Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://koha-community.org/", "defaultStatus": "unaffected", "product": "Koha", "programFiles": ["reports/bor_issues_top.pl"], "repo": "https://gitlab.com/koha-community/Koha", "vendor": "Koha Community", "versions": [{"lessThanOrEqual": "24.11.17", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "25.05.12", "status": "affected", "version": "25.05.00", "versionType": "semver"}, {"lessThanOrEqual": "25.11.06", "status": "affected", "version": "25.11.00", "versionType": "semver"}, {"lessThanOrEqual": "26.05.01", "status": "affected", "version": "26.05.00", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."}, {"lang": "es", "value": "El script reports/bor_issues_top.pl de Koha construye SQL din\u00e1mico en la subrutina calculate concatenando varios par\u00e1metros de solicitud controlados por el usuario directamente en la cadena de consulta. El par\u00e1metro \u2019Criteria\u2019 solo se normaliza mediante un prefijo de nombre de tabla y nunca se incluye en una lista blanca, aterrizando textualmente en posiciones de identificador (SELECT DISTINCTROW, GROUP BY, ORDER BY); los valores de filtro se concatenan en bruto en fragmentos de LIKE, BETWEEN y comparaci\u00f3n entre comillas simples, y el par\u00e1metro \u2019Limit\u2019 se a\u00f1ade en bruto a una cl\u00e1usula LIMIT. Un usuario de personal autenticado con el permiso del m\u00f3dulo de informes puede inyectar SQL arbitrario y leer cualquier tabla accesible por el usuario de la base de datos de Koha, incluyendo borrowers (hashes de contrase\u00f1as, secretos de doble factor, datos personales), api_keys y sessions."}], "id": "CVE-2026-70372", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70372", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T17:22:31.575799Z", "version": "2.0.3"}}]}, "published": "2026-08-04T13:18:58.040", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://koha-community.org/koha-25-05-12-released/"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,24.11.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.05.00,25.05.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.11.00,25.11.06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.05.00,26.05.01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Koha", "source": "cna", "vendor": "Koha Community"}, "product": "koha", "vendor": "koha-community"}], "created": "2026-08-04T14:45:03.072923+00:00", "updated": "2026-08-10T23:15:05.951146+00:00", "vendors": ["koha-community", "koha-community$PRODUCT$koha"]}