Koha's guided report builder concatenates the "order_by" CGI parameter and a related "{order}_ovalue" parameter directly into an SQL ORDER BY clause without validation or escaping. This flaw allows a staff user with the create_reports or execute_reports permission to perform timed blind SQL injection against the Koha database, exposing personally identifying information and authentication data.

Koha, the open-source library management system released by Koha Community. Version information was not supplied in the advisory, so all installations possibly affected until an official patch is released.

The CVSS score of 8.8 marks this finding as high severity, and the advisory notes that the attack requires only a low‑privilege staff account with report‑generation permissions, which are commonly granted to non‑admin library staff. Because it is a time‑based blind injection, an attacker must perform the attack over multiple queries, which increases effort but is still feasible with automated tools. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the potential for data exposure gives it significant risk.