A stored SQL injection exists in Koha when a patron's language field is saved. The injection is limited to the use of sqli constructed SLEEP functions, which can be leveraged to cause a time‑based denial of service. Each time an issue slip is printed for the affected patron the stored payload is concatenated into a subquery, scaling linearly with the specified sleep value and the number of slip‑news rows. No data exfiltration is possible due to the 25‑character column length, but the repeated execution can exhaust system resources and disrupt availability for the staff responsible for printing slips.

The flaw is present in the Koha Community system for releases up to 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Only users with the borrowers permission group and the edit_borrowers privilege are able to input malicious values, and the impact manifests when a staff member prints an issue slip for the patron whose language field contains the payload.

The CVSS score is 4.3, indicating a moderate risk level. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited in the wild. The attack vector is likely local, requiring that an attacker gain authenticated staff access with the relevant permission. Because the payload only produces timing delays, the difficulty of exploitation is low for an insider or compromised account, while the overall threat to confidentiality is none but availability is degraded.