CVE-2026-6428
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-89
Neutralización incorrecta de elementos especiales usados en un comando SQL (Inyección SQL)
Fecha de publicación:
13/06/2026
Última modificación:
13/06/2026
Descripción
*** Pendiente de traducción *** SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.<br />
<br />
<br />
<br />
The vulnerable sink in sub calculate concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters:<br />
<br />
<br />
<br />
my $f = @$filters[0];<br />
$f =~ s/\*/%/g;<br />
$strsth2 .= " AND $column LIKE &#39;$f&#39; ";<br />
<br />
<br />
<br />
This enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions.<br />
<br />
<br />
<br />
Proof of concept (error-based, single request):<br />
<br />
<br />
<br />
GET /cgi-bin/koha/reports/catalogue_out.pl?do_it=1&output=screen&Limit=10&Criteria=branchcode&Filter=x&#39;+AND+EXTRACTVALUE(1,CONCAT(0x7e,VERSION(),0x7c,USER(),0x7c,DATABASE(),0x7e))--+-<br />
Cookie: CGISESSID=<br />
<br />
<br />
<br />
The response body contains the DBI exception leaking the MariaDB version, database user, client IP, and database name, after which arbitrary data can be paged out using LIMIT n,1 / SUBSTRING(...).<br />
<br />
<br />
<br />
The vulnerable sink was introduced in commit 6bb77ae3e4 (2008-07-09); CVE-2015-4633 patched the same class in sibling files but did not generalise the fix to reports/catalogue_out.pl. Fixed in Koha 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, and 26.11.00 by replacing the raw concatenation with a parameterised placeholder.
Impacto
Puntuación base 4.0
5.60
Gravedad 4.0
MEDIA
Puntuación base 3.x
7.60
Gravedad 3.x
ALTA
Puntuación base 2.0
7.50
Gravedad 2.0
ALTA