CVE-2026-105107

Executive Summary

CVE-2026-105107 is an authenticated SQL injection vulnerability in the Koha integrated library system, specifically in the "Most-circulated items" report generated by the reports/cat_issues_top.pl script (sub calculate). A staff user holding only the reports module permission (not requiring superlibrarian) can inject arbitrary SQL through the user-controlled Criteria, Filter, and Limit request parameters, which are concatenated directly into dynamic SQL statements. Successful exploitation allows an attacker to read any table accessible to the Koha database user, including the borrowers table (user IDs, bcrypt password hashes, two-factor secrets, and personal data), api_keys, and sessions, resulting in high-confidentiality impact consistent with the CVSS score of 7.6.

Technical Analysis

The vulnerability resides in the Koha staff reporting module, specifically the reports/cat_issues_top.pl script and its calculate subroutine. The affected report is the "Most-circulated items" report.

The root cause is improper neutralization of special elements used in SQL commands (CWE-89). Three user-controlled request parameters are incorporated into dynamic SQL without safe parameter binding:

• Criteria: According to the NVD description, this parameter is "only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query)." This means the attacker controls SQL identifier context.
• Filter: Filter values are "concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments" — i.e., value positions inside string literals and comparison clauses.
• Limit: The Limit parameter is "appended raw to a LIMIT clause."

The distinction between identifier-position and value-position injection is important: allow-list validation of identifiers is the only generally safe approach for dynamic identifiers, and here that validation is absent. Because the Filter values are inserted raw into single-quoted fragments, quote-based breakout is feasible; because Criteria reaches GROUP BY, ORDER BY, SELECT DISTINCTROW, and the main calculation query verbatim, injection there does not necessarily even require string-quote manipulation.

Authentication is required. The attacker must be an authenticated staff user with the reports module permission — the description explicitly notes this does not require superlibrarian privileges, meaning the privilege bar is relatively low for a Koha staff account.

The NVD description further states this is "the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372)," indicating a parallel code pattern in a sibling report script. This suggests the weakness is a recurring pattern in the reporting subsystem rather than a single isolated defect, and that auditing for structurally similar concatenation patterns in other reports is warranted.

Insufficient technical detail is available in the provided data to enumerate exact SQL statement bodies, parameter parsing code, or the precise prefix-normalization routine applied to Criteria. No function names beyond calculate, no additional file paths beyond reports/cat_issues_top.pl (and the sibling reports/bor_issues_top.pl), and no additional parameter names beyond Criteria, Filter, and Limit should be assumed.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-105107, and no exploit code or Nuclei template exists as of this writing. The attack chain below is inferred strictly from the vulnerability class (authenticated SQL injection) and the parameter behaviors documented in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed Koha instance running an affected release. Koha deployments are commonly reachable via Shodan using HTTP title/body fingerprints for the OPAC and staff interfaces. The attacker needs valid staff credentials with the reports module permission; this may be obtained via credential stuffing, phishing, password reuse, a low-privileged insider, or compromise of any existing staff account.

2. Triggering the flaw class. With an authenticated staff session, the attacker navigates to the "Most-circulated items" report (reports/cat_issues_top.pl) and supplies crafted values in the Criteria, Filter, and/or Limit request parameters. Because these parameters are concatenated directly into dynamic SQL — Criteria into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, main calculation query), Filter raw into single-quoted LIKE/BETWEEN/comparison fragments, and Limit raw into a LIMIT clause — no server-side validation stops the injected content.

3. Payload / execution method (vulnerability-class level). The attacker injects SQL syntax into whichever parameter offers the cleanest injection context. For Filter, value-position injection requires breaking out of the surrounding single-quoted fragment. For Criteria, identifier-position injection may permit manipulating the SELECT list, grouping, ordering, or the structure of the main calculation query without quote breakout. For Limit, malformed clause content may permit additional clause manipulation depending on the database backend. The objective at this stage is arbitrary SQL execution against the Koha database using the privileges of the application's database user.

4. Post-exploitation impact. With arbitrary SQL read capability, the attacker targets the tables named in the description: borrowers (README: userid and bcrypt password hashes, two-factor secrets, and personal data), api_keys, and sessions. Harvested password hashes enable offline cracking; leaked two-factor secrets defeat a second authentication factor; harvested api_keys and sessions allow session/API impersonation. Personal data exposure against the patron/staff table constitutes a privacy and regulatory incident. The description also notes the attacker can read "any table reachable by the Koha database user," so the full blast radius depends on the database user's grants (broad read access is the practical expectation for an application account).

No public exploitation in the wild has been reported in the supplied data, and CVE-2026-105107 is not listed in CISA KEV.

Impact Assessment

CVSS 3.1 base score: 7.6 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.

• Attack Vector (AV:N — Network): exploitable remotely over the network against the Koha web interface.
• Attack Complexity (AC:L — Low): no special conditions or race windows required; the parameters are processed directly.
• Privileges Required (PR:L — Low): an authenticated staff account with the reports module permission is needed — explicitly not a superlibrarian.
• User Interaction (UI:N — None): no victim interaction is required beyond the attacker's own authenticated session.
• Scope (S:U — Unchanged): impact remains within the vulnerable component's security authority.
• Confidentiality (C:H — High): unrestricted read of database tables including borrowers, api_keys, and sessions.
• Integrity (I:L — Low) and Availability (A:L — Low): the described vector is primarily read-oriented, but injected SQL in identifier/value/clause positions can, in principle, influence query results and behavior with limited impact.

Business impact: Koha is widely deployed in public libraries, academic institutions, and consortia, where patron records, credential material, and staff identity data are held. Exposure of bcrypt password hashes, 2FA secrets, API keys, and active sessions enables follow-on account takeover, lateral movement into integrated services, and large-scale privacy breaches subject to library-privacy statutes and data protection regulations. Because access requires only a non-superlibrarian staff account, the insider-risk and credential-stuffing blast radius is meaningful.

Detection Guidance

Sigma Rule

title: Koha Most-Circulated Items Report - SQL Injection Attempt (CVE-2026-105107)
id: 3f7c2b91-1a4e-4d0c-9e4a-koha105107
status: experimental
description: Detects SQL metacharacters or injection patterns in requests to the Koha reports/cat_issues_top.pl script via Criteria, Filter, or Limit parameters.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105107
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/reports/cat_issues_top.pl'
  selection_params:
    cs-uri-query|contains:
      - 'Criteria='
      - 'Filter='
      - 'Limit='
  selection_sqli:
    cs-uri-query|contains:
      - 'UNION'
      - 'SELECT'
      - 'SLEEP'
      - 'BENCHMARK'
      - 'information_schema'
      - '0x'
      - '%27'
      - '--'
      - '/*'
      - 'AND 1=1'
      - 'OR 1=1'
  condition: selection_endpoint and selection_params and selection_sqli
falsepositives:
  - Legitimate staff reports containing SQL keywords in free-text filter fields (rare)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-105107

YARA Rule

rule CVE_2026_105107_Koha_SQLi_Request
{
    meta:
        description = "Detects HTTP request patterns targeting Koha reports/cat_issues_top.pl SQL injection (CVE-2026-105107)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105107"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep   = "cat_issues_top.pl" ascii nocase
        $p1   = "Criteria=" ascii nocase
        $p2   = "Filter=" ascii nocase
        $p3   = "Limit=" ascii nocase
        $sq1  = "UNION" ascii nocase wide
        $sq2  = "information_schema" ascii nocase wide
        $sq3  = "SLEEP(" ascii nocase wide
        $sq4  = "BENCHMARK(" ascii nocase wide
        $sq5  = "' OR " ascii nocase wide
        $sq6  = "\" OR " ascii nocase wide
        $cmt1 = "-- " ascii wide
        $cmt2 = "/*" ascii wide

    condition:
        $ep and (any of ($p1, $p2, $p3)) and (any of ($sq*)) and (any of ($cmt*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105107 Koha Most-Circulated Items Report SQL Injection Attempt"; flow:established,to_server; http.uri; content:"/reports/cat_issues_top.pl"; nocase; http.uri; content:"Criteria"; nocase; http.uri; pcre:"/(Criteria|Filter|Limit)=[^&]*(UNION|SELECT|SLEEP|BENCHMARK|information_schema|%27|--|\/\*)/i"; classtype:web-application-attack; reference:cve,2026-105107; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105107; sid:2026105107; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "GET" and
      http.request.uri : "*/reports/cat_issues_top.pl*" ]
  [ network where http.request.uri : "*cat_issues_top.pl*" and
      ( http.request.uri : "*Criteria=*" or http.request.uri : "*Filter=*" or http.request.uri : "*Limit=*" ) and
      ( http.request.uri : "*UNION*" or http.request.uri : "*information_schema*" or
        http.request.uri : "*SLEEP(*" or http.request.uri : "*BENCHMARK(*" or
        http.request.uri : "*%27*" or http.request.uri : "*--*" or http.request.uri : "*/*" ) ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx:plus:access
| search uri="*/reports/cat_issues_top.pl*"
| eval q = lower(urldecode(uri))
| where match(q, "(criteria|filter|limit)=.*(union|select|sleep\(|benchmark\(|information_schema|%27|--|/\*)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user, status
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,koha,">
  <rule id="105107" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>cat_issues_top\.pl</match>
    <regex type="pcre2">(?:Criteria|Filter|Limit)=[^&]*(?:UNION|SELECT|SLEEP\(|BENCHMARK\(|information_schema|%27|--|/\*)</regex>
    <description>CVE-2026-105107: Possible SQL injection attempt against Koha Most-circulated items report (reports/cat_issues_top.pl)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,cve_2026_105107,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description nevertheless documents explicit fixed versions; the 0/4 rating reflects the absence of patch evidence in the tracked sources for this feed, not the absence of upstream fixes. Treat the fix versions below as the definitive remediation targets while validating against vendor advisory channels.

1. Immediate mitigations

   • If the fixed versions cannot be deployed immediately, restrict access to the staff reports module and the reports/cat_issues_top.pl endpoint to trusted network ranges (VPN/zero-trust gateway), and enforce least-privilege: audit which staff accounts hold the reports module permission and remove it where not operationally required.
   • Review and reduce the privileges of the Koha database user so that a SQL injection cannot read beyond the minimum required tables (principle of least privilege at the DB layer) — this is defense-in-depth and does not remediate the flaw.
   • Monitor for anomalous requests to the report script carrying SQL metacharacters (see Detection Guidance) and alert on any staff account accessing cat_issues_top.pl outside normal reporting workflows.

2. Patch / upgrade steps

   • Upgrade Koha to a fixed release: 24.11.19, 25.05.14, 25.11.08, or 26.05.03 (or the 26.11 development branch), per the NVD description. Organizations on out-of-cycle branches should backport the corresponding upstream fix.
   • Given the description states this is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372), also apply the fix for CVE-2026-70372 and verify both scripts are addressed by the same upgrade cycle.
   • After upgrading, rotate material potentially exposed pre-patch: Koha staff/patron credentials and 2FA secrets (as appropriate), API keys in api_keys, and invalidate active sessions in sessions.

3. Long-term hardening

   • Convert all dynamic SQL in the reporting subsystem to prepared statements with bind parameters; where dynamic identifiers are unavoidable, enforce strict server-side allow-lists for columns, tables, and sort/group clauses — never prefix-normalization alone.
   • Perform a systematic audit of report scripts for the same concatenation pattern across the codebase (the sibling-script note indicates a recurring pattern).
   • Enforce quarterly dependency/version reviews and subscribe to Koha security announcements.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105107
• Related CVE (unpatched twin, sibling script): https://nvd.nist.gov/vuln/detail/CVE-2026-70372
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Koha project security advisories / release notes for versions 24.11.19, 25.05.14, 25.11.08, 26.05.03 (verify the fix commit and advisory on the official Koha release channel)

Exploit-in-the-wild evidence: none provided; CVE-2026-105107 is not listed in CISA KEV and no public PoC, Nuclei template, or exploit code was identified in the supplied data. EPSS has not yet been scored by FIRST.org and is not estimated here.