CVE-2026-70371 (GCVE-0-2026-70371)
Vulnerability from cvelistv5
Published
2026-08-04 13:00
Modified
2026-08-10 11:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-89 - SQL Injection
Summary
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Koha Community | Koha |
Version: 0 ≤ 24.11.17 Version: 25.05.00 ≤ 25.05.12 Version: 25.11.00 ≤ 25.11.06 Version: 26.05.00 ≤ 26.05.01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:21:38.231269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:21:56.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/issues_avg_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:10.726Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:42.609Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/issues_avg_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70371",
"datePublished": "2026-08-04T13:00:10.726Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:42.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-70371\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-04T17:21:38.231269Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-04T17:21:52.111Z\"}}], \"cna\": {\"title\": \"Koha - SQL Injection in reports/issues_avg_stats.pl\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Sanjar Tulkinov Anvar o\u0027g\u0027li\"}], \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"repo\": \"https://gitlab.com/koha-community/Koha\", \"vendor\": \"Koha Community\", \"product\": \"Koha\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"24.11.17\"}, {\"status\": \"affected\", \"version\": \"25.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"25.05.12\"}, {\"status\": \"affected\", \"version\": \"25.11.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"25.11.06\"}, {\"status\": \"affected\", \"version\": \"26.05.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"26.05.01\"}], \"programFiles\": [\"reports/issues_avg_stats.pl\"], \"collectionURL\": \"https://koha-community.org/\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-08-04T13:00:10.726Z\", \"references\": [{\"url\": \"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://koha-community.org/koha-25-05-12-released/\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://download.koha-community.org/koha-25.05.12.tar.gz\", \"tags\": [\"third-party-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Koha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eKoha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 SQL Injection\"}]}], \"providerMetadata\": {\"orgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"shortName\": \"TuranSec\", \"dateUpdated\": \"2026-08-10T11:44:42.609Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-70371\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T11:44:42.609Z\", \"dateReserved\": \"2026-08-04T07:13:07.992Z\", \"assignerOrgId\": \"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c\", \"datePublished\": \"2026-08-04T13:00:10.726Z\", \"assignerShortName\": \"TuranSec\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…