CVE-2026-31844
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. A low-privileged staff user can inject arbitrary SQL queries via crafted requests to this parameter, allowing execution of unintended SQL statements and exposure of sensitive database information. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
| CWE | CWE-89 |
| Vendor | koha community |
| Product | koha |
| Published | Mar 11, 2026 |
| Last Updated | Mar 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for koha community koha
Be the first to know when new high vulnerabilities affecting koha community koha are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Koha Community / Koha
24.11.0 < 24.11.12 25.05.0 < 25.05.07 25.11.0 < 25.11.01
References
Credits
Raximov Shukrulloh (Mothra)