Executive brief
Koha is an open-source library management system used by libraries worldwide to manage book acquisitions, patron records, and other library operations. An authenticated staff member with acquisitions permissions can exploit a SQL injection vulnerability in the parcels page to read the entire database, including patron personal information, staff password hashes, and two-factor authentication secrets. The vulnerability requires a valid staff login but affects sensitive institutional and patron data.
Technical details
The vulnerability is a second-order SQL injection in the acquisitions module (acqui/parcels.pl) where the orderby request parameter is passed to C4::Acquisition::GetInvoices(). While the function allow-lists the column name, it concatenates the sort direction (ASC/DESC) directly into the SQL ORDER BY clause without validation. An authenticated staff user with acquisition => order_receive permission can inject arbitrary SQL using inline comments (/**/) to bypass the space-delimiter check, allowing blind time-based extraction of database contents including borrower PII, bcrypt password hashes, and 2FA secrets. The injection point is in the ORDER BY direction token, a distinct variant of similar vulnerabilities reported in report wizards (bugs 42735-42738). Patches were released in versions 24.11.18, 25.05.13, 25.11.07, and 26.05.02 and later.
Affected products
- Koha Community Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01
Timeline
- 2026-06-02: disclosed: Vulnerability reported to Bugzilla
- 2026-09-03: patched: Patches released in versions 24.11.18, 25.05.13, 25.11.07, 26.05.02 and later