SQL Injection in Koha Library Reports Module

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Koha's reports/issues_avg_stats.pl script contains a critical SQL injection vulnerability where user-controlled parameters are directly concatenated into dynamic SQL queries without validation or parameterization. The vulnerable parameters—Line, Column, and Filter fields—are inserted into sensitive SQL positions including SELECT DISTINCTROW, GROUP BY, ORDER BY clauses, and comparison operators, allowing authenticated staff users with reports module permissions to inject arbitrary SQL commands. This vulnerability affects Koha library management systems and matters significantly because even though it requires authentication, the lack of input validation means a compromised or malicious staff account can extract, modify, or delete sensitive library data including patron information, transaction records, and system configurations.

Casky's 322 matching skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability by correlating multiple MITRE ATT&CK techniques: TA0001 (Initial Access/Reconnaissance) through analysis of how attackers probe Koha installations for report parameters, and TA0043 (Resource Development) in crafting SQL injection payloads. Practitioners using Casky would identify detection opportunities across their security infrastructure including log analysis showing unusual SQL syntax in web requests to reports/issues_avg_stats.pl, database query anomalies revealing unexpected table joins or subqueries, and behavioral indicators of data exfiltration following successful injection attempts. The platform's skills would specifically flag requests containing SQL keywords (UNION, SELECT, DROP) within seemingly benign filter parameters, parameter values exceeding expected length patterns, and database queries diverging from the baseline statistical query patterns—enabling defenders to catch exploitation attempts before data compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-70371.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-70371

Casky has 322 skills that investigate the attack patterns behind CVE-2026-70371. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn