SQL Injection in Koha Reports Module Allows Data Exfiltration

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/. The vulnerable sink in sub calculate concatenates the unmodified Filter request parameter directly into a LIKE clause of the auxiliary $strsth2 statement and executes it via DBI without bound parameters: my $f = @$filters[0]; $f =~ s/\*/%/g; $strsth2 .= " AND $column LIKE '$f' "; This enables error-based SQL injection (e.g., via EXTRACTVALUE) and full read access to sensitive tables including borrowers (password hashes, 2FA secrets, PII), borrower_password_recovery, api_keys, and sessions. Proof of concept (error-based, single request): GET /cgi-bin/koha/reports/c

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a SQL injection flaw in Koha's reports/catalogue_out.pl module that allows authenticated staff users with Reports module permissions to extract arbitrary data from the application database. The vulnerability exists because the Filter URL parameter is concatenated directly into SQL queries without proper sanitization when the Criteria parameter matches 'branchcode'. While requiring authenticated access limits the immediate blast radius, Koha is widely deployed in library systems globally, and staff accounts are common targets for both insider threats and credential compromise. An attacker with legitimate or stolen staff credentials can systematically exfiltrate sensitive patron data, transaction records, and other confidential information stored in the Koha database.

Casky's 301 matched security skills enable detection of this attack pattern through Claude AI's extended reasoning across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would observe attack indicators including: anomalous SQL syntax patterns in web application logs (CWE-89 manifestations), unusual Filter parameter values containing SQL operators (UNION, SELECT, WHERE clauses), repeated database query attempts from authenticated sessions accessing reports they don't typically use, and database access logs showing queries selecting from sensitive tables via the catalogue_out.pl endpoint. The platform's skill mapping helps security teams correlate these technical indicators with the reconnaissance phase of attacks, enabling faster identification of attempts to gather information before lateral movement or data exfiltration escalates. Teams should prioritize patching Koha instances and implementing Web Application Firewall (WAF) rules to validate Filter parameters against expected patterns.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-6428.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-6428

Casky has 301 skills that investigate the attack patterns behind CVE-2026-6428. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn