Koha’s reports module contains a script that builds dynamic SQL by interpolating user‑supplied Line and Column request parameters directly into identifier positions such as SELECT DISTINCTROW, GROUP BY, and ORDER BY without any whitelist validation. This oversight allows an attacker to inject arbitrary SQL, enabling the execution of any query that the Koha database user is permitted to run. Consequently, a malicious actor could read or potentially modify sensitive information stored in the Koha database, including personal data, authentication credentials, and other confidential records. The vulnerability therefore represents a significant confidentiality breach.

The flaw exists in the Koha Community Edition wherever the reports module and the reports/catalogue_stats.pl script are deployed. No specific product version is delineated in the advisory, but the fix is packaged in the 25.05.12 release; all earlier installations that have not applied this update remain susceptible.

The CVSS score of 8.8 classifies the issue as high severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog. The primary attack vector is likely via web requests to the vulnerable script, and the script is typically accessible only to users with staff‑level permissions within the reports module. Despite the limited access requirement, the potential for accessing sensitive database contents warrants immediate attention and remediation.