CVE-2026-31844: Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31844?
CVE-2026-31844 has been classified with a high severity due to its potential for executing arbitrary SQL queries by low-privileged users.
How do I fix CVE-2026-31844?
To fix CVE-2026-31844, update Koha to the latest version that addresses the SQL injection vulnerability.
Who is affected by CVE-2026-31844?
CVE-2026-31844 affects Koha systems where low-privileged staff users can exploit the vulnerability to access sensitive data.
What are the implications of CVE-2026-31844?
The implications of CVE-2026-31844 include unauthorized access to sensitive information and potential database manipulation.
Is CVE-2026-31844 easy to exploit?
CVE-2026-31844 can be exploited by users with low privileges, making it relatively easy for malicious actors to access sensitive data.