Koha’s guided report builder reads CGI parameters and concatenates them directly into an ORDER BY clause without any validation or allowlist. Because ORDER BY columns cannot be parameterized, the script must build the clause as a string, and the absence of sanitization allows an attacker to inject arbitrary SQL. This flaw can be used to execute read or even destructive SQL commands, potentially exposing patron information, staff credentials, or other sensitive database contents.

All installations of Koha Community’s Koha database management system that include the guided_reports.pl script are potentially affected, as the advisory does not specify a version range. Any version that ships with this script could be vulnerable.

The CVSS score of 8.8 flags the flaw as high severity, and the EPSS score of less than 1 percent indicates a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to submit crafted requests to guided_reports.pl – for example, via the web interface – but the advisory does not specify user privilege requirements, leaving the attack reach uncertain. Nonetheless, if exploitation occurs it could allow unauthorized database access with potentially high impact.