{"id":"CVE-2026-71288","published":"2026-08-05T13:24:53.583","lastModified":"2026-08-10T12:17:31.513","description":"Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Koha-Community/Koha","tags":[]},{"url":"https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl","tags":[]}],"exploitRefs":[{"url":"https://github.com/Koha-Community/Koha","tags":[]},{"url":"https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to inject SQL commands via the guided report builder, leading to potential data manipulation or theft.","exploitability":"Exploitation is moderately hard as it requires crafting specific SQL injection payloads, but preconditions include having access to the affected parameter.","blast_radius":"If exploited, attackers could manipulate or steal sensitive data, impacting the integrity and confidentiality of the system.","remediation":"Upgrade to the latest version of Koha, specifically the one that addresses this vulnerability, e.g., 'Upgrade to 4.20.1 or later'.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","sql-injection","web","data-leak"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:18:31.398Z"}}