CVE-2026-71288: Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl
Koha's guided report builder (reports/guidedreports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71288?
The severity of CVE-2026-71288 is rated as high with a score of 8.8.
How do I fix CVE-2026-71288?
To fix CVE-2026-71288, validate and sanitize the `order_by` parameter and `{order}_ovalue` parameters before using them in SQL queries.
What type of vulnerability is CVE-2026-71288?
CVE-2026-71288 is classified as an SQL Injection vulnerability.
What components are affected by CVE-2026-71288?
CVE-2026-71288 affects the Koha guided report builder, specifically the guided_reports.pl file.
What impact does CVE-2026-71288 have?
CVE-2026-71288 could allow an attacker to manipulate SQL queries, potentially leading to unauthorized data access or system compromise.