CVE-2026-31844: Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. A low-privileged staff user can inject arbitrary SQL queries via crafted requests to this parameter, allowing execution of unintended SQL statements and exposure of sensitive database information. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31844?
CVE-2026-31844 has been classified with a high severity due to its potential for executing arbitrary SQL queries by low-privileged users.
How do I fix CVE-2026-31844?
To fix CVE-2026-31844, update Koha to the latest version that addresses the SQL injection vulnerability.
Who is affected by CVE-2026-31844?
CVE-2026-31844 affects Koha systems where low-privileged staff users can exploit the vulnerability to access sensitive data.
What are the implications of CVE-2026-31844?
The implications of CVE-2026-31844 include unauthorized access to sensitive information and potential database manipulation.
Is CVE-2026-31844 easy to exploit?
CVE-2026-31844 can be exploited by users with low privileges, making it relatively easy for malicious actors to access sensitive data.