https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:01:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349679 EUVD-2026-349679 https://cve.radiocsirt.org/vuln/euvd-2026-349679 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71288 <p>Koha&#39;s guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.</p> <p>Koha&#39;s guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71288 https://cve.radiocsirt.org/vuln/ghsa-q274-qf66-4hq6 <p>Koha&#39;s guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: `my @order_by = $input-&gt;multi_param(&#39;order_by&#39;); foreach my $order (@order_by) { my $value = $input-&gt;param($order . &#34;_ovalue&#34;); $query_orderby = &#34; ORDER BY $order $value&#34;; }`. The resulting string is appended verbatim to the final query in C4::Reports::Guided (`$query .= $orderby;`) with no escaping. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist. Any staff account with the low-privilege create_reports or execute_reports permission (commonly granted to non-admin library staff) can perform time-based blind SQL injection against the Koha database, which stores patron PII and staff/LDAP credentials.</p> <p>Koha&#39;s guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: `my @order_by = $input-&gt;multi_param(&#39;order_by&#39;); foreach my $order (@order_by) { my $value = $input-&gt;param($order . &#34;_ovalue&#34;); $query_orderby = &#34; ORDER BY $order $value&#34;; }`. The resulting string is appended verbatim to the final query in C4::Reports::Guided (`$query .= $orderby;`) with no escaping. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist. Any staff account with the low-privilege create_reports or execute_reports permission (commonly granted to non-admin library staff) can perform time-based blind SQL injection against the Koha database, which stores patron PII and staff/LDAP credentials.</p> https://cve.radiocsirt.org/vuln/ghsa-q274-qf66-4hq6