The Koha Library Send Basket feature in versions prior to 23.05.10 allows a remote attacker to perform a time‑based SQL injection against the POST parameter bib_list. This flaw, a classic CWE‑89 vulnerability, lets the attacker extract arbitrary data from the underlying database, compromising confidentiality of user and library information.

The vulnerability affects the Koha open‑source library management system produced by the Koha community. Any deployment running Koha 23.05 or earlier, specifically before the 23.05.10 release, is susceptible. No other version numbers are listed in the advisory.

The CVSS base score is 9.8, indicating critical severity, though the EPSS indicates a very low likelihood of exploitation (under 1%) and it is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP POST request to /cgi-bin/koha/opac-sendbasket.pl that a user can trigger from the web interface; the attacker does not need prior authentication but must be a library user to submit the form. Once exploited, data disclosure can occur, potentially exposing sensitive patron or catalog data.