CVE-2026-71288

{
  "id": "CVE-2026-71288",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-05T13:24:53.583",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist."
    },
    {
      "lang": "es",
      "value": "El generador de informes guiado de Koha (reports/guided_reports.pl) lee el parámetro CGI ’order_by’ y, para cada valor, un parámetro llamado dinámicamente ’{order}_ovalue’, y concatena ambos directamente en una cláusula SQL ORDER BY sin lista de permitidos ni validación: ’my @order_by = $input  ->  multi_param(’order_by’); foreach my $order (@order_by) { my $value = $input  ->  param($order . “_ovalue”); $query_orderby = “ ORDER BY $order $value”; }’. La cadena resultante se añade textualmente a la consulta final en C4::Reports::Guided (’$query .= $orderby;’) sin escape. Dado que las columnas ORDER BY no pueden vincularse a través de marcadores de posición de sentencias preparadas, esto requiere una lista de permitidos explícita, que no existe. Cualquier cuenta de personal con el permiso de bajo privilegio create_reports o execute_reports (comúnmente concedido al personal de la biblioteca no administrador) puede realizar una inyección SQL ciega basada en tiempo contra la base de datos de Koha, que almacena PII de los usuarios y credenciales de personal/LDAP."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "Koha Community",
          "product": "Koha",
          "defaultStatus": "unaffected",
          "programFiles": [
            "reports/guided_reports.pl",
            "C4/Reports/Guided.pm"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "26.05.01-1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T15:49:52.767160Z",
          "id": "CVE-2026-71288",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Koha-Community/Koha",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}