Technical impact
Koha’s reports/issues_avg_stats.pl constructs SQL queries by concatenating user‑supplied request parameters directly into the query string. The Line and Column parameters are inserted verbatim into the SELECT, GROUP BY, and ORDER BY clauses, and each Filter slot is concatenated into literal LIKE, BETWEEN, and comparison fragments without using bound parameters. This technique of building dynamic SQL without input validation or parameterization creates a vulnerability that can be exploited to inject arbitrary SQL. The description does not explicitly state whether authentication is required; it is inferred that a user with access to the reports feature could supply the relevant parameters, allowing malicious queries that may read or modify any database objects that the Koha database user has permissions to access.
Affected Systems
The flaw is present in any Koha Community installation that includes the reports/issues_avg_stats.pl file. No specific version range is delineated in the advisory, but the issue was addressed in the 25‑05‑12 release as indicated by the provided download and release URLs.
Risk and Exploitability
The vulnerability carries a CVSS score of 8.8, indicating high severity. Its EPSS score is less than 1 %, suggesting a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. The description does not explicitly state an authentication requirement; it is inferred that a user with access to the reports feature could supply the relevant parameters. Once those conditions are met, exploitation can lead to the execution of arbitrary SQL statements, potentially exposing sensitive data or altering database contents.
