Koha SQL Injection via Unvalidated Report Parameters

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation. When Line contains itemcallnumber and the cotedigits parameter is truthy, cotedigits is additionally concatenated raw as the numeric argument of a LEFT() call. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Koha's reports/catalogue_stats.pl module contains a critical SQL injection vulnerability where user-controlled Line and Column request parameters are directly interpolated into SQL identifier positions without validation. This affects authenticated staff users with reports module permissions who can inject arbitrary SQL through dynamic query construction in the calculate subroutine. The vulnerability is particularly dangerous because it manipulates structural query elements (SELECT DISTINCTROW, GROUP BY, ORDER BY clauses) rather than just data values, allowing attackers to fundamentally alter query logic, extract sensitive library data, or potentially execute administrative operations within the database context.

Casky's 322 mapped skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability by analyzing both MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance - Gather Information). Practitioners would observe detections for SQL injection attack patterns (CWE-89) through behavioral analysis of request parameters flowing into SQL construction without sanitization, parameter tampering attempts in report generation endpoints, and anomalous SQL syntax in database query logs. The platform's skill mapping would flag unvalidated identifier concatenation, absence of prepared statement usage, and missing input whitelisting mechanisms—surfacing the exact code paths where Line/Column/cotedigits parameters bypass security controls, enabling security teams to prioritize remediation of this high-severity issue affecting their Koha implementations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-70370.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-70370

Casky has 322 skills that investigate the attack patterns behind CVE-2026-70370. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn