SQL Injection Vulnerability in Koha Library Management System

CVE-2026-70370

What is CVE-2026-70370?

The Koha Library Management System's reports module is susceptible to an SQL injection vulnerability. The issue arises from the way the application constructs dynamic SQL queries in the catalogue_stats.pl script. User-controlled parameters for Line and Column are directly interpolated into critical parts of the SQL query without proper validation. This flaw allows an authenticated user with reports module permissions to launch SQL injection attacks, potentially allowing them to access sensitive information from the database, including personal data, password hashes, two-factor authentication secrets, API keys, and session data. The impact of this vulnerability underscores the importance of proper input handling and SQL query construction in web applications.

References