CVE-2026-72609

{
  "id": "CVE-2026-72609",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-11T12:17:44.120",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en Koha hasta 24.11.17, 25.05.12, 25.11.06, y 26.05.01 permite al personal autenticado con el permiso de adquisición =mayor que recepción_de_pedidos leer contenido arbitrario de la base de datos a través del parámetro de solicitud orderby en acqui/parcels.pl. El parámetro se pasa a C4::Acquisition::GetInvoices, que valida en lista blanca el nombre de la columna pero concatena el token de dirección en bruto en la cláusula SQL ORDER BY sin validación. La explotación es ciega (basada en tiempo) en producción y permite la extracción de PII de los usuarios, hashes de contraseñas bcrypt del personal y secretos de doble factor."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "Koha Community",
          "product": "Koha",
          "versions": [
            {
              "version": "0",
              "lessThan": "24.11.18",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "25.05.0",
              "lessThan": "25.05.13",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "25.11.0",
              "lessThan": "25.11.07",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "26.05.0",
              "lessThan": "26.05.02",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T12:05:12.929371Z",
          "id": "CVE-2026-72609",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://koha-community.org/",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}