CVE-2026-71288: Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder (reports/guidedreports.pl) reads the orderby CGI parameter and, for each value, a dynamically-named {order}ovalue parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: my @orderby = $input->multiparam('orderby'); foreach my $order (@orderby) { my $value = $input->param($order . "ovalue"); $queryorderby = " ORDER BY $order $value"; }. The resulting string is appended verbatim to the final query in C4::Reports::Guided ($query .= $orderby;) with no escaping. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist. Any staff account with the low-privilege createreports or executereports permission (commonly granted to non-admin library staff) can perform time-based blind SQL injection against the Koha database, which stores patron PII and staff/LDAP credentials.