CVE-2026-6428 (GCVE-0-2026-6428)
Vulnerability from cvelistv5
Published
2026-06-13 16:34
Modified
2026-08-10 11:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Koha Community | Koha |
Version: 0 ≤ 22.11.38 Version: 23.05.00 ≤ 23.11.15 Version: 24.05.00 ≤ 24.11.16 Version: 25.05.00 ≤ 25.05.11 Version: 25.11.00 ≤ 25.11.05 Version: 26.05.00 ≤ 26.05.01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T17:19:10.550362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T17:19:39.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/catalogue_out.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "22.11.38",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "23.11.15",
"status": "affected",
"version": "23.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.11.16",
"status": "affected",
"version": "24.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.11",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.05",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov (Sanjarbiy)"
}
],
"datePublic": "2026-06-13T16:34:10.326Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\u003c/p\u003e"
}
],
"value": "SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An authenticated staff user holding the Reports module permission can inject arbitrary SQL into the auxiliary $strsth2 statement built inside sub calculate when $tablename eq \u0027branches\u0027. Because the statement is sent to DBI without bound parameters, the attacker can read any row and column accessible to the Koha application database user, including the borrowers table (password hashes, two-factor authentication secrets, personally identifiable information), borrower_password_recovery, api_keys, sessions, and all circulation data. Error-based exfiltration is single-request (EXTRACTVALUE) and exposed through the DBI exception surfaced by the Reports CGI; time-based extraction and denial of service against the database remain possible even after the related information-disclosure issue (Koha bug 42366) is patched."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "An authenticated staff user holding the Reports module flag sends a crafted GET request to /cgi-bin/koha/reports/catalogue_out.pl with Criteria=branchcode and a malicious Filter parameter to read arbitrary data from the Koha application database."
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:35.818Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameter",
"tags": [
"issue-tracking",
"vendor-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361"
},
{
"name": "Bug 42361: Fix SQL injection in catalogue_out.pl (official patch)",
"tags": [
"patch",
"vendor-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539"
},
{
"name": "Koha Community Security Releases",
"tags": [
"vendor-advisory"
],
"url": "https://koha-community.org/security-releases/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter",
"x_author": "Sanjar Tulkinov (Sanjarbiy)"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-6428",
"datePublished": "2026-06-13T16:34:10.326Z",
"dateReserved": "2026-04-16T12:58:10.800Z",
"dateUpdated": "2026-08-10T11:44:35.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-6428\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-15T17:19:10.550362Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-15T17:19:27.650Z\"}}], \"cna\": {\"title\": \"Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Sanjar Tulkinov (Sanjarbiy)\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An authenticated staff user holding the Reports module permission can inject arbitrary SQL into the auxiliary $strsth2 statement built inside sub calculate when $tablename eq \u0027branches\u0027. Because the statement is sent to DBI without bound parameters, the attacker can read any row and column accessible to the Koha application database user, including the borrowers table (password hashes, two-factor authentication secrets, personally identifiable information), borrower_password_recovery, api_keys, sessions, and all circulation data. Error-based exfiltration is single-request (EXTRACTVALUE) and exposed through the DBI exception surfaced by the Reports CGI; time-based extraction and denial of service against the database remain possible even after the related information-disclosure issue (Koha bug 42366) is patched.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.6, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber\", \"exploitMaturity\": \"PROOF_OF_CONCEPT\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"An authenticated staff user holding the Reports module flag sends a crafted GET request to /cgi-bin/koha/reports/catalogue_out.pl with Criteria=branchcode and a malicious Filter parameter to read arbitrary data from the Koha application database.\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"vectorString\": \"AV:N/AC:L/Au:S/C:C/I:N/A:P\", \"authentication\": \"SINGLE\", \"integrityImpact\": \"NONE\", \"accessComplexity\": \"LOW\", \"availabilityImpact\": \"PARTIAL\", \"confidentialityImpact\": \"COMPLETE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://gitlab.com/koha-community/Koha\", \"vendor\": \"Koha Community\", \"product\": \"Koha\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"22.11.38\"}, {\"status\": \"affected\", \"version\": \"23.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"23.11.15\"}, {\"status\": \"affected\", \"version\": \"24.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"24.11.16\"}, {\"status\": \"affected\", \"version\": \"25.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"25.05.11\"}, {\"status\": \"affected\", \"version\": \"25.11.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"25.11.05\"}, {\"status\": \"affected\", \"version\": \"26.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"26.05.01\"}], \"programFiles\": [\"reports/catalogue_out.pl\"], \"collectionURL\": \"https://koha-community.org/\", \"defaultStatus\": \"unaffected\"}], \"x_author\": \"Sanjar Tulkinov (Sanjarbiy)\", \"datePublic\": \"2026-06-13T16:34:10.326Z\", \"references\": [{\"url\": \"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361\", \"name\": \"Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameter\", \"tags\": [\"issue-tracking\", \"vendor-advisory\"]}, {\"url\": \"https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539\", \"name\": \"Bug 42361: Fix SQL injection in catalogue_out.pl (official patch)\", \"tags\": [\"patch\", \"vendor-advisory\"]}, {\"url\": \"https://koha-community.org/security-releases/\", \"name\": \"Koha Community Security Releases\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"shortName\": \"TuranSec\", \"dateUpdated\": \"2026-08-10T11:44:35.818Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-6428\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T11:44:35.818Z\", \"dateReserved\": \"2026-04-16T12:58:10.800Z\", \"assignerOrgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"datePublished\": \"2026-06-13T16:34:10.326Z\", \"assignerShortName\": \"TuranSec\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…