Koha’s reports module script reports/bor_issues_top.pl builds SQL queries by directly concatenating user-controlled request parameters into the query string. An authenticated staff user who has permission to run reports can therefore inject arbitrary SQL. This flaw enables the attacker to read any table that the Koha database user can access, including borrower records (containing password hashes, two-factor secrets and personal data), api_keys, and session tables, leading to the exfiltration of sensitive application data and compromising data confidentiality.

The vulnerability affects Koha Community installations where the reports module is enabled and a staff account holds the reports permission. The flaw resides in the script that constructs SQL queries by directly concatenating user-supplied request parameters.

Exploitation requires only an authenticated staff user with the reports permission; no additional privileges are necessary. The CVSS score of 8.8 indicates high severity. The EPSS score is below 1%, suggesting a low probability of exploitation but still possible. The vulnerability is not listed in the CISA KEV catalog. The primary risk is high-level information disclosure; the likelihood depends on the exposure of the Koha installation and the distribution of the reports permission.