The reports module in Koha cleanses no user-supplied parameters used in constructing a SQL query. It concatenates the values of PeriodTypeSel, PeriodDaySel, PeriodMonthSel, filter slots, and SQL column identifiers directly into the statement string. This behaviour constitutes a classic SQL injection flaw (CWE-89) that permits an attacker to inject or substitute SQL code and potentially read, modify, or delete database contents.

Koha Community Edition is affected. All releases before 25.05.12 contain the vulnerable logic, as indicated by the vendor references. Any installation that exposes the reports module to users can be impacted.

The CVSS score of 8.8 classifies the vulnerability as high severity, while the EPSS score of less than 1% suggests a low but non-zero probability of exploitation at the time of analysis. No public exploits have been documented, and the issue is not listed in CISA’s KEV catalog. The exploitation path involves supplying crafted parameters to the reports module; although the description does not explicitly state authentication requirements, the module generally requires staff-level access to generate circulation statistics. If an attacker gains access or injects malicious input, they can execute arbitrary SQL within the scope of the Koha database user.