SQL Injection in Koha Acquisition Reports Statistics

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The statement is prepared and executed with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a SQL injection flaw in Koha's acquisition statistics reporting module that allows authenticated staff users with report permissions to execute arbitrary SQL queries. By manipulating filter parameters in the reports/acquisitions_stats.pl script, attackers can inject malicious SQL code directly into WHERE clause fragments affecting multiple database tables including acquisitions baskets, orders, vendors, items, and budgets. The vulnerability matters because Koha is a widely-used open-source library management system, and SQL injection provides direct database access for data exfiltration, manipulation, or destruction. While requiring authentication, the threat is significant since internal staff accounts are common attack vectors and the reports module permission set is typically broad across library organizations.

Casky's 322 matched skills help practitioners detect the attack patterns behind this vulnerability by mapping to MITRE ATT&CK Technique TA0001 (Reconnaissance) and TA0043 (Reconnaissance), enabling detection of reconnaissance activities as attackers probe filter parameters and database schema. Through extended reasoning across security skills, Claude AI identifies the hallmarks of SQL injection exploitation: unusual SQL syntax in HTTP request parameters, database error messages exposed in responses, and patterns of escalating query complexity in filter inputs. Practitioners using Casky would observe findings highlighting parameter tampering attempts, unexpected SQL keywords in acquisition report requests, and database access anomalies—signals that distinguish legitimate statistical queries from injection attempts targeting the unvalidated WHERE clause construction in calculate subroutines.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-70369.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-70369

Casky has 322 skills that investigate the attack patterns behind CVE-2026-70369. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn