CVE-2026-72610 in Koha
Summary
by MITRE • 08/11/2026
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->search_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical stored SQL injection flaw in Koha library management systems affecting versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. The issue stems from improper input sanitization within the Koha::AdditionalContents->search_for_display method where user-supplied data is directly concatenated into database queries without adequate validation or escaping mechanisms. The vulnerability specifically targets the patron lang field which serves as an attack vector for authenticated staff members who possess the borrowers => edit_borrowers permission level, making this a privilege escalation concern within the system's access control framework.
The technical exploitation occurs through a time-based denial of service attack pattern where malicious SQL payloads are stored in the 25-character limited patron language field. When an issue slip is subsequently printed for the affected patron, the stored payload executes within a subquery context, causing database servers to pause execution for specified time intervals through sleep functions. This methodology aligns with common time-based SQL injection techniques categorized under CWE-89 and specifically represents a variant of CWE-463 where the system's trust in user input leads to execution of malicious code. The limited column size constrains exploitation to timing attacks rather than data extraction, but the cumulative effect creates significant operational impact as each subsequent issue slip print triggers the payload execution.
The operational impact of this vulnerability scales linearly with both the SLEEP value specified in the payload and the number of slip-news rows configured in the system. This means that malicious actors can cause progressively longer delays in printing operations, effectively creating a denial of service condition that disrupts normal library workflows. The vulnerability affects all patrons whose data has been compromised through this field, potentially impacting multiple users simultaneously when issue slips are printed for groups or when batch operations occur. The persistence of the attack vector through stored data makes this particularly dangerous as it can continue to impact system performance long after initial compromise, and the timing-based nature provides stealthy operation that may go unnoticed by administrators.
Mitigation strategies should focus on immediate input validation and sanitization within the Koha::AdditionalContents->search_for_display method to prevent raw user data from being directly incorporated into database queries. Implementing proper parameterized queries or prepared statements would eliminate the risk of SQL injection regardless of input content. Additionally, system administrators should consider implementing stricter input length limits and character validation for fields that store user-supplied content, particularly those used in database operations. The vulnerability demonstrates the importance of principle of least privilege where even authenticated users with edit permissions should not be able to execute potentially destructive code through seemingly benign data fields. Organizations should also implement monitoring solutions to detect unusual delays in printing operations that could indicate exploitation attempts, aligning with ATT&CK technique T1499.004 for network denial of service attacks and the broader category of T1566 for credential access through privilege escalation mechanisms.