An SQL injection flaw in Koha’s reports/catalogue_out.pl allows an authenticated staff member with Reports module privileges to inject a malicious LIKE clause via the Filter URL parameter when the Criteria field is set to branchcode. This flaw permits an attacker to read any table in the Koha database, including sensitive borrower details, password hashes, two‑factor secrets, API keys, and session data. The vulnerability is identified as CWE‑89 and is limited to data exfiltration, not arbitrary code execution.

The issue exists in Koha Community Edition versions 22.11.37 and earlier, all 23.x releases, every 24.x release prior to 24.11.16, every 25.05.x prior to 25.05.11, every 25.11.x prior to 25.11.05, every 26.05.x prior to 26.05.01, and every 26.11.x prior to 26.11.00. All affected builds are maintained by the Koha Community and are distributed under the Koha project.

With a CVSS score of 5.6 the flaw is considered medium severity; the EPSS metric is not available, and it is not listed in the CISA KEV catalog. An attacker who is authenticated and has the Reports flag can launch an error‑based SQL injection by sending a crafted request such as the example in the advisory. The exploitation does not require elevated privilege beyond the staff account, but once the flaw is abused any database table can be read, exposing highly sensitive data. Because the vulnerability is only exploitable by users who already have access to the reports interface, immediate patching is the most effective mitigation.