Koha Community’s acquisition module contains an SQL injection flaw that permits authenticated staff with the acquisition => order_receive permission to supply an unvalidated ORDER BY direction token via the orderby request parameter. The backend function concatenates the supplied direction directly into the SQL query, enabling an attacker to embed time‑based payloads that reveal arbitrary database content. An attacker can therefore retrieve sensitive patron personally identifiable information, staff bcrypt password hashes, and two‑factor authentication secrets.

Koha Community releases up through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 are affected. The vulnerability resides in the acqui/parcels.pl script of the Koha acquisition application.

The CVSS score of 7.1 denotes a high severity vulnerability. While the EPSS score is not available, the flaw requires no special software privileges beyond standard staff authentication, which is often granted in library environments, making exploitation relatively straightforward. The attack vector is web‑based and possible to carry out from any network location that can reach the Koha instance, although the attacker must first obtain valid staff credentials. The vulnerability is not listed in the CISA KEV catalog, but the potential for credential theft and exposure of sensitive data warrants prompt attention.