{"id":"CVE-2026-72609","aliases":["EUVD-2026-56130","GHSA-f66q-gpm5-hp2p"],"status":"published","title":"Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl","description":"An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition =\u003e order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00371,"percentile":0.3132,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-08-11T11:22:44Z","modified":"2026-10-24T15:10:00Z","products":[{"vendor":"koha community","product":"koha"}],"references":[{"url":"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749"},{"url":"https://koha-community.org/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72609"},{"url":"https://koha-community.org"},{"url":"https://github.com/advisories/GHSA-f66q-gpm5-hp2p"}],"sources":{"cve":[{"id":"CVE-2026-72609","title":"Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl","description":"An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition =\u003e order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.","status":"published","published":"2026-08-11T11:22:44.903Z","modified":"2026-08-11T12:06:02.672Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:52.016971Z"}],"euvd":[{"id":"EUVD-2026-56130","description":"An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition =\u003e order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.","status":"published","published":"2026-08-11T11:22:44Z","modified":"2026-08-11T12:06:02Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T18:02:00.742322Z"}],"ghsa":[{"id":"GHSA-f66q-gpm5-hp2p","title":"An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows...","description":"An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition =\u003e order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.","status":"published","published":"2026-08-11T12:30:28Z","modified":"2026-08-11T12:30:34Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:10:17.025827Z"}],"nvd":[{"id":"CVE-2026-72609","description":"An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition =\u003e order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.","status":"published","published":"2026-08-11T12:17:44.12Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:36.499002Z"}]}}