Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-31844

Authenticated SQL Injection in Koha displayby parameter of suggestion.pl

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TuranSec

Description

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Koha Community Koha

Default version status: unaffected

  • 24.11.0 to ≤ 24.11.12affected
  • 25.05.0 to ≤ 25.05.07affected
  • 25.11.0 to ≤ 25.11.01affected

References