CVE-2026-70373 Overview
CVE-2026-70373 is a SQL injection vulnerability in Koha's circulation statistics report script reports/issues_stats.pl. The sub calculate routine concatenates several user-controlled request parameters directly into the SQL query string. An authenticated staff user with the reports module permission can inject arbitrary SQL and read any table accessible to the Koha database user. Sensitive tables include borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is classified as [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated staff attackers can exfiltrate password hashes, two-factor secrets, API keys, and session data from the Koha database.
Affected Products
- Koha Integrated Library System (circulation statistics report reports/issues_stats.pl)
- Koha releases prior to 25.05.12
- Koha instances exposing the reports module to staff users
Discovery Timeline
- 2026-08-04 - CVE-2026-70373 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70373
Vulnerability Analysis
The vulnerability resides in the calculate subroutine of reports/issues_stats.pl, the Koha circulation statistics report. The script builds its query by concatenating request parameters directly into the SQL string rather than using prepared statements or bound placeholders. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments. The Filter slots plus the Line and Column identifiers are interpolated with no whitelist and no placeholder binding.
An authenticated staff user holding the reports module permission can break out of the intended query context and append arbitrary SQL clauses. The injected payload executes with the privileges of the Koha database user, which typically has full read access to every table in the Koha schema.
Root Cause
The root cause is failure to parameterize SQL statements. Identifier slots such as Line and Column are not validated against a whitelist of expected column names, and value slots such as PeriodTypeSel are not passed as bind parameters. Both string concatenation for values and unvalidated identifier interpolation contribute to the injection surface.
Attack Vector
Exploitation requires network access to the Koha staff interface and valid credentials for an account holding the reports module permission. The attacker submits a crafted request to reports/issues_stats.pl where one or more of the parameters PeriodTypeSel, PeriodDaySel, PeriodMonthSel, Filter, Line, or Column contains SQL syntax that breaks out of the intended fragment. UNION-based extraction against tables such as borrowers, api_keys, and sessions allows retrieval of credentials and active session tokens, which can then be used to escalate to higher-privileged staff accounts.
No verified public proof-of-concept code is available. Refer to the Koha Bug Report #42735 for technical details.
Detection Methods for CVE-2026-70373
Indicators of Compromise
- Requests to /cgi-bin/koha/reports/issues_stats.pl containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in PeriodTypeSel, PeriodDaySel, PeriodMonthSel, Filter, Line, or Column parameters.
- Web server or Koha access logs showing unusually long query strings targeting issues_stats.pl from staff sessions.
- Database query logs containing malformed WHERE fragments or unexpected references to borrowers, api_keys, or sessions tables originating from the reports script.
Detection Strategies
- Deploy a web application firewall rule that inspects parameters submitted to reports/issues_stats.pl for SQL syntax and rejects requests containing UNION, comment markers, or stacked queries.
- Enable MySQL or MariaDB general query logging on the Koha database and alert on queries referencing api_keys or borrowers.password originating from the reports code path.
- Correlate staff authentication events with subsequent report requests to identify anomalous access patterns from a single account.
Monitoring Recommendations
- Monitor for staff accounts with the reports permission that begin issuing high volumes of statistics report requests outside normal working hours.
- Track outbound data volumes from the Koha application server for signs of bulk data extraction.
- Review audit logs for privilege changes granting the reports module permission to newly created or dormant accounts.
How to Mitigate CVE-2026-70373
Immediate Actions Required
- Upgrade Koha to version 25.05.12 or later by applying the Koha Release Tarball 25.05.12.
- Audit staff accounts and revoke the reports module permission from any account that does not require it.
- Rotate credentials, API keys, and session secrets if exploitation is suspected, since borrowers, api_keys, and sessions may have been exposed.
Patch Information
The fix is included in Koha 25.05.12. Review the Koha Release Announcement 25.05.12 and the Koha Bug Report #42735 for the corrective commits that introduce parameter binding and identifier whitelisting in reports/issues_stats.pl.
Workarounds
- Restrict network access to the Koha staff interface to trusted management networks or VPN clients until the patch is applied.
- Temporarily remove the reports module permission from all non-administrative staff accounts.
- Place a web application firewall in front of the staff interface with rules that block SQL metacharacters in the vulnerable parameters.
# Configuration example: upgrade Koha to the patched release
wget https://download.koha-community.org/koha-25.05.12.tar.gz
tar -xzf koha-25.05.12.tar.gz
cd koha-25.05.12
perl Makefile.PL
make && make test && sudo make install
sudo systemctl restart koha-common
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
