{"id":"CVE-2026-71288","published":"2026-08-05T13:24:53.583","lastModified":"2026-08-10T12:17:31.513","description":"Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Koha-Community/Koha","tags":[]},{"url":"https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl","tags":[]}],"exploitRefs":[{"url":"https://github.com/Koha-Community/Koha","tags":[]},{"url":"https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows SQL injection by directly concatenating unvalidated input into an SQL ORDER BY clause without proper allowlisting or validation, leading to potential data manipulation and theft.","exploitability":"Exploitation is relatively easy given that no input validation exists, requiring only crafting a malicious query parameter.","blast_radius":"If exploited, this could result in unauthorized access to sensitive database records, potentially affecting multiple users or systems.","remediation":"Implement strict input validation and allowlisting for all user inputs in the SQL query construction process.","tags":["sql-injection","rce","web","database"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:47:46.863Z"}}