CVE-2026-31844

HIGH

8.8

Descripcion

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. A low-privileged staff user can inject arbitrary SQL queries via crafted requests to this parameter, allowing execution of unintended SQL statements and exposure of sensitive database information. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/11/2026

Ultima modificacion3/11/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-89

Referencias

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593(309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)

https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/(309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)

https://koha-community.org/koha-25-11-01-released/(309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.