Executive brief
Koha is a free and open-source library management system used by libraries to catalog items and manage patron data. A vulnerability allows authenticated staff members with batch modification permissions to inject malicious SQL code into automatic item modification rules. When the system's scheduled maintenance job runs, this injected code executes against the database, allowing attackers to read sensitive data including patron personal information and staff password hashes.
Technical details
This is a stored SQL injection vulnerability (CWE-89) in Koha's automatic item modification by age feature. The vulnerability exists in the `agefield` parameter of automatic item modification rules, which is accepted and stored verbatim without validation in `tools/automatic_item_modification_by_age.pl`. When the scheduled cron job (`misc/cronjobs/automatic_item_modification_by_age.pl`) executes, it calls `C4::Items::ToggleNewStatus`, which interpolates the stored `agefield` value directly into a SQL query without parameterization. An authenticated attacker with `tools_items_batchmod` permission can craft a malicious rule containing SQL injection payloads in the agefield; the injection triggers when the cron job runs and can execute SELECT queries to extract arbitrary database contents, including patron PII and bcrypt password hashes. Under standard MariaDB/MySQL DBI single-statement execution, time-based blind SQL injection via SLEEP is also achievable.
Affected products
- Koha Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01
Timeline
- 2026-08-11: disclosed: CVE-2026-72607 published on NVD
- 2026-06-02: advisory: Vulnerability reported to Koha Bugzilla
- 2026-09-03: patched: Patches released in versions 26.11.00, 26.05.02, 25.11.07, 25.05.13, 24.11.18