CVE-2026-71288

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71288", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.968Z", "datePublished": "2026-08-05T12:26:34.034Z", "dateUpdated": "2026-08-10T11:47:19.921Z"}, "containers": {"cna": {"title": "Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl", "descriptions": [{"lang": "en", "value": "Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Koha Community", "product": "Koha", "programFiles": ["reports/guided_reports.pl", "C4/Reports/Guided.pm"], "versions": [{"version": "0", "lessThanOrEqual": "26.05.01-1", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/Koha-Community/Koha", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Saidakbarxon Maxsudxonov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:19.921Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T12:26:34.034Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:49:52.767160Z", "id": "CVE-2026-71288", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:49:58.066Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71288", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:49:52.767160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:49:55.357Z"}}], "cna": {"title": "Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Saidakbarxon Maxsudxonov"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.05.01-1"}], "programFiles": ["reports/guided_reports.pl", "C4/Reports/Guided.pm"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T12:26:34.034Z", "references": [{"url": "https://github.com/Koha-Community/Koha", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.", "supportingMedia": [{"type": "text/html", "value": "<p>Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:19.921Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71288", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:47:19.921Z", "dateReserved": "2026-08-05T12:23:34.968Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:26:34.034Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Koha", "programFiles": ["reports/guided_reports.pl", "C4/Reports/Guided.pm"], "vendor": "Koha Community", "versions": [{"lessThanOrEqual": "26.05.01-1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist."}, {"lang": "es", "value": "El generador de informes guiado de Koha (reports/guided_reports.pl) lee el par\u00e1metro CGI \u2019order_by\u2019 y, para cada valor, un par\u00e1metro llamado din\u00e1micamente \u2019{order}_ovalue\u2019, y concatena ambos directamente en una cl\u00e1usula SQL ORDER BY sin lista de permitidos ni validaci\u00f3n: \u2019my @order_by = $input -> multi_param(\u2019order_by\u2019); foreach my $order (@order_by) { my $value = $input -> param($order . \u201c_ovalue\u201d); $query_orderby = \u201c ORDER BY $order $value\u201d; }\u2019. La cadena resultante se a\u00f1ade textualmente a la consulta final en C4::Reports::Guided (\u2019$query .= $orderby;\u2019) sin escape. Dado que las columnas ORDER BY no pueden vincularse a trav\u00e9s de marcadores de posici\u00f3n de sentencias preparadas, esto requiere una lista de permitidos expl\u00edcita, que no existe. Cualquier cuenta de personal con el permiso de bajo privilegio create_reports o execute_reports (com\u00fanmente concedido al personal de la biblioteca no administrador) puede realizar una inyecci\u00f3n SQL ciega basada en tiempo contra la base de datos de Koha, que almacena PII de los usuarios y credenciales de personal/LDAP."}], "id": "CVE-2026-71288", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71288", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:49:52.767160Z", "version": "2.0.3"}}]}, "published": "2026-08-05T13:24:53.583", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/Koha-Community/Koha"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.05.01-1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Koha", "source": "cna", "vendor": "Koha Community"}, "product": "koha", "vendor": "koha-community"}], "created": "2026-08-05T15:15:05.783073+00:00", "updated": "2026-08-10T21:30:04.093453+00:00", "vendors": ["koha-community", "koha-community$PRODUCT$koha"]}