CVE-2026-70372

{
  "id": "CVE-2026-70372",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-04T13:18:58.040",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."
    },
    {
      "lang": "es",
      "value": "El script reports/bor_issues_top.pl de Koha construye SQL dinámico en la subrutina calculate concatenando varios parámetros de solicitud controlados por el usuario directamente en la cadena de consulta. El parámetro ’Criteria’ solo se normaliza mediante un prefijo de nombre de tabla y nunca se incluye en una lista blanca, aterrizando textualmente en posiciones de identificador (SELECT DISTINCTROW, GROUP BY, ORDER BY); los valores de filtro se concatenan en bruto en fragmentos de LIKE, BETWEEN y comparación entre comillas simples, y el parámetro ’Limit’ se añade en bruto a una cláusula LIMIT. Un usuario de personal autenticado con el permiso del módulo de informes puede inyectar SQL arbitrario y leer cualquier tabla accesible por el usuario de la base de datos de Koha, incluyendo borrowers (hashes de contraseñas, secretos de doble factor, datos personales), api_keys y sessions."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "Koha Community",
          "product": "Koha",
          "defaultStatus": "unaffected",
          "collectionURL": "https://koha-community.org/",
          "programFiles": [
            "reports/bor_issues_top.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "24.11.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "25.05.00",
              "lessThanOrEqual": "25.05.12",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "25.11.00",
              "lessThanOrEqual": "25.11.06",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "26.05.00",
              "lessThanOrEqual": "26.05.01",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-04T17:22:31.575799Z",
          "id": "CVE-2026-70372",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://download.koha-community.org/koha-25.05.12.tar.gz",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://koha-community.org/koha-25-05-12-released/",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}