CVE-2026-71288: Koha Guided Report Builder SQLi Flaw

CVE-2026-71288 Overview

CVE-2026-71288 is a SQL injection vulnerability in Koha's guided report builder script reports/guided_reports.pl. The script concatenates the order_by CGI parameter and its dynamically-named {order}_ovalue counterpart directly into an SQL ORDER BY clause without validation or allowlisting. Any authenticated staff user holding the low-privilege create_reports or execute_reports permission can exploit the flaw to execute time-based blind SQL injection against the Koha database. The database stores patron personally identifiable information (PII) and staff or LDAP credentials, making the impact significant. The weakness is classified under CWE-89.

Critical Impact
Low-privilege library staff accounts can extract patron PII and staff/LDAP credentials from the Koha database via blind SQL injection.

Affected Products

Koha Integrated Library System (open-source)
reports/guided_reports.pl guided report builder
C4::Reports::Guided Perl module

Discovery Timeline

2026-08-05 - CVE-2026-71288 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71288

Vulnerability Analysis

The guided report builder accepts multiple order_by values via $input->multi_param('order_by'). For each returned column name, the script fetches a companion parameter named {order}_ovalue using $input->param($order . "_ovalue"). Both values are appended directly to the SQL string used to build the final query: $query_orderby = " ORDER BY $order $value";. The concatenated fragment then reaches C4::Reports::Guided where $query .= $orderby; completes the query without escaping or parameterization.

SQL ORDER BY targets cannot be bound as prepared-statement placeholders. Safe implementations must therefore validate column names and sort direction tokens against an explicit allowlist. That control is absent in the affected code path, exposing the entire query surface to attacker-controlled text.

Root Cause

The root cause is unsanitized string concatenation of user-supplied HTTP parameters into a SQL clause that cannot use bind parameters. The absence of an allowlist for both the column identifier and the sort direction token permits arbitrary SQL fragments to be injected. This is a textbook CWE-89 pattern applied to the ORDER BY position.

Attack Vector

An authenticated attacker holding the create_reports or execute_reports permission submits a crafted request to the guided reports endpoint. The order_by parameter carries a SQL payload, and the matching {order}_ovalue parameter carries additional injectable content. Time-based blind techniques such as conditional SLEEP() calls allow the attacker to exfiltrate rows containing patron records and credential material stored in the Koha database.

// No verified exploit code is published for this CVE.
// Refer to the Koha source at reports/guided_reports.pl for the vulnerable pattern.

Detection Methods for CVE-2026-71288

Indicators of Compromise

Web server access logs showing requests to /cgi-bin/koha/reports/guided_reports.pl with unusually long or SQL-token-bearing order_by values.
Presence of SLEEP(, BENCHMARK(, SELECT, UNION, or comment sequences (--, /*) inside order_by or *_ovalue query parameters.
Database sessions originating from the Koha application user exhibiting long query durations tied to guided report execution.

Detection Strategies

Inspect HTTP request logs for order_by and {order}_ovalue parameters that contain SQL keywords, whitespace-encoded payloads, or non-column-name characters.
Enable MySQL or MariaDB general query logging on the Koha database and alert on ORDER BY clauses containing function calls or subqueries.
Correlate staff account activity with report-execution endpoints to spot low-privilege accounts issuing large volumes of guided report requests.

Monitoring Recommendations

Baseline normal guided_reports.pl request patterns and alert on deviations in parameter length or entropy.
Monitor slow-query logs for repeated timing anomalies consistent with time-based blind SQL injection.
Track use of the create_reports and execute_reports permissions and review which staff roles hold them.

How to Mitigate CVE-2026-71288

Immediate Actions Required

Revoke create_reports and execute_reports permissions from staff accounts that do not require them.
Restrict network access to the Koha staff interface using IP allowlists or VPN gating until a patched release is deployed.
Rotate any staff or LDAP credentials that may have been exposed through the Koha database.

Patch Information

Apply the fix published by the Koha Community once available. Track upstream commits in the Koha Community Repository and review changes to the guided reports script. The remediation must introduce an explicit allowlist for sortable column names and for sort direction tokens (ASC, DESC).

Workarounds

Temporarily disable the guided reports feature for non-administrator roles by removing the create_reports and execute_reports permissions.
Front the Koha application with a web application firewall rule that rejects order_by and *_ovalue parameters containing characters other than [A-Za-z0-9_].
Enforce database-side read-only credentials for the Koha reporting user where feasible to limit injection impact.

bash

# Example WAF pattern (ModSecurity) rejecting SQL tokens in order_by parameters
SecRule ARGS_NAMES "@rx ^(order_by|.+_ovalue)$" \
    "chain,id:1071288,phase:2,deny,status:403,msg:'Koha guided_reports SQLi attempt'"
    SecRule ARGS "@rx (?i)(select|union|sleep|benchmark|--|/\*|;)" "t:none"