Technical impact
Koha’s acquisition statistics report constructs per‑cell SQL queries by inserting user‑controlled filter parameters directly into the WHERE clause for various columns. Because parameter binding is absent, the query can be manipulated. The CVE description does not detail authentication or authorization requirements, so the analysis does not assume particular user roles are needed. The flaw is a classic SQL injection (CWE‑89) that may allow an attacker to execute arbitrary SQL against the database, potentially exposing or altering data that the Koha database user is permitted to access.
Affected Systems
The vulnerability is present in the Koha Community edition. The 25.05.12 release, referenced in the advisory, contains the unparameterized acquisition statistics report code and is therefore vulnerable. Any Koha release that includes the same code without a fix remains susceptible. Users should verify whether later releases contain the patch and determine if their current deployment is affected.
Risk and Exploitability
Exploitation requires sending a crafted request to the vulnerable report endpoint with the injected filter parameters. The CVE description does not specify any authentication or permission prerequisites, so it is unknown whether any user context is necessary. The absence of bound parameters makes the injection straightforward once the endpoint is reached. The EPSS score is below 1% and the issue is not listed in KEV, while the CVSS score of 8.8 indicates a high severity. The potential impact of the flaw is that an attacker could retrieve or modify data accessible to the Koha database account, leading to a breach of confidentiality and integrity.
