Koha Community up to 24.11.17/25.05.12/25.11.06/26.05.01 SQL Query Construction acqui/parcels.pl GetInvoices orderby sql injection

Summaryinfo

A vulnerability, which was classified as critical, was found in Koha Community Koha up to 24.11.17/25.05.12/25.11.06/26.05.01. This affects the function C4::Acquisition::GetInvoices of the file acqui/parcels.pl of the component SQL Query Construction. Such manipulation of the argument orderby leads to sql injection. This vulnerability is uniquely identified as CVE-2026-72609. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Koha Community Koha up to 24.11.17/25.05.12/25.11.06/26.05.01. Affected by this issue is the function C4::Acquisition::GetInvoices of the file acqui/parcels.pl of the component SQL Query Construction. The manipulation of the argument orderby with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

The advisory is available at bugs.koha-community.org. This vulnerability is handled as CVE-2026-72609 since 08/10/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

Upgrading to version 24.11.18, 25.05.13, 25.11.07 or 26.05.02 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-56130). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Koha Community

Name

• Koha

Version

• 24.11.0
• 24.11.1
• 24.11.2
• 24.11.3
• 24.11.4
• 24.11.5
• 24.11.6
• 24.11.7
• 24.11.8
• 24.11.9
• 24.11.10
• 24.11.11
• 24.11.12
• 24.11.13
• 24.11.14
• 24.11.15
• 24.11.16
• 24.11.17
• 25.05.0
• 25.05.1
• 25.05.2
• 25.05.3
• 25.05.4
• 25.05.5
• 25.05.6
• 25.05.7
• 25.05.8
• 25.05.9
• 25.05.10
• 25.05.11
• 25.05.12
• 25.11.06
• 26.05.01

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion