CVE-2026-70371

{
  "id": "CVE-2026-70371",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-04T13:18:57.930",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters."
    },
    {
      "lang": "es",
      "value": "El reports/issues_avg_stats.pl de Koha construye SQL dinámico en la subrutina calculate concatenando varios parámetros de solicitud controlados por el usuario directamente en la cadena de consulta. Los parámetros Line y Column no se validan contra ninguna lista blanca y aterrizan textualmente en posiciones de identificador (SELECT DISTINCTROW, GROUP BY, ORDER BY), y cada ranura de filtro se concatena en bruto en fragmentos de LIKE, BETWEEN y comparación entre comillas simples sin parámetros vinculados. Un usuario de personal autenticado que posee el permiso del módulo de informes puede inyectar SQL arbitrario y leer cualquier tabla accesible por el usuario de la base de datos de Koha, incluyendo prestatarios (hashes de contraseñas, secretos de doble factor, datos personales), api_keys y sesiones."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "Koha Community",
          "product": "Koha",
          "defaultStatus": "unaffected",
          "collectionURL": "https://koha-community.org/",
          "programFiles": [
            "reports/issues_avg_stats.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "24.11.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "25.05.00",
              "lessThanOrEqual": "25.05.12",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "25.11.00",
              "lessThanOrEqual": "25.11.06",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "26.05.00",
              "lessThanOrEqual": "26.05.01",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-04T17:21:38.231269Z",
          "id": "CVE-2026-70371",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://download.koha-community.org/koha-25.05.12.tar.gz",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://koha-community.org/koha-25-05-12-released/",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}