CVE-2026-72609

Executive Summary

CVE-2026-72609 is a blind time-based SQL injection vulnerability in Koha, the open-source integrated library system, affecting all versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. An authenticated staff member possessing the acquisition => order_receive permission can exploit an unsanitized direction token in the orderby request parameter passed to the acqui/parcels.pl script, enabling arbitrary database reads. Successful exploitation results in the exfiltration of patron personally identifiable information (PII), staff bcrypt password hashes, and two-factor authentication secrets, with a CVSS score of 7.1 (High). No patch is currently available from any tracked source; the vulnerability remains unpatched as of this writing.

Technical Analysis

The vulnerability resides in Koha's acquisition module, specifically within the acqui/parcels.pl script. The NVD description indicates that the orderby request parameter is passed to C4::Acquisition::GetInvoices, a Perl function responsible for retrieving invoice records. The flaw is twofold:

1. Column Name Allow-Listing: The function correctly validates and allow-lists the column name portion of the orderby parameter, ensuring only valid database columns can be referenced in the SQL ORDER BY clause.

2. Unsanitized Direction Token: However, the direction component (ASC/DESC) is concatenated directly into the raw SQL ORDER BY clause without validation. This creates a SQL injection vector where an attacker can inject arbitrary SQL syntax into the direction token position, breaking out of the intended query structure.

The injection is classified as blind (time-based). In production environments, the attacker cannot directly observe query results because web application responses do not reflect database output. Instead, the attacker leverages conditional time delays (e.g., IF(condition, SLEEP(n), 0) in MySQL, or equivalent constructs) to infer data one bit or character at a time. This makes exploitation slower but highly effective for systematic data extraction.

Attack Surface: The vulnerability requires authentication as a staff member with the acquisition => order_receive permission. This is a relatively low-privilege role within the Koha staff interface — personnel responsible for receiving ordered items do not typically require elevated administrative rights. In many library deployments, this permission is broadly granted to acquisition and cataloging staff, expanding the practical attack surface beyond system administrators.

Underlying Technology: Koha is built on Perl with a MySQL/MariaDB backend. The SQL injection payload would be crafted to execute within MySQL's ORDER BY clause context. Time-based blind injection in MySQL typically uses constructs such as (SELECT IF(condition, SLEEP(n), 0)) as an injected expression.

Limitations from Available Data: The NVD description provides no additional code examples, no specific payload strings that have been observed in the wild, and no researcher analysis. The exact injection syntax beyond the conceptual mechanism is not documented in the provided data.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-72609. The attack chain is inferred from the vulnerability class (blind time-based SQL injection) and the technical details provided in the NVD description.

Step 1 — Reconnaissance/Target Identification: An attacker with valid staff credentials for a Koha deployment begins by authenticating to the staff interface (typically accessible via a web browser on the intranet or over the internet if the OPAC/staff interface is exposed). The attacker must locate the acqui/parcels.pl endpoint and confirm their session has the required acquisition => order_receive permission. Reconnaissance may involve testing whether the orderby parameter is accepted and whether different direction tokens (e.g., ASC, DESC) produce distinct response times.

Step 2 — Triggering the Flaw Class: The attacker crafts an HTTP request to acqui/parcels.pl that includes a malicious orderby parameter. The legitimate value would be a valid column name followed by a direction token (e.g., orderby=invoice_number DESC). The injection occurs when the attacker substitutes the direction token with an SQL expression that the database will evaluate. Because the column name is allow-listed, the attacker must inject the malicious payload through the direction token position.

Step 3 — Payload/Execution Method (Class-Level): At the vulnerability-class level, the attacker uses time-based SQL injection. The payload is designed to cause the database to delay its response by a measurable amount of time when a specific logical condition is true, and return quickly when false. Example conceptual approach (not an actual observed payload): the attacker appends an expression that sleeps for N seconds if a subquery (e.g., extracting the first character of a secret) matches a guessed value. By iterating through candidate characters and measuring response times, the attacker reconstructs arbitrary data from the database. The ORDER BY context is sufficient for this technique because the injected expression can be evaluated during query execution and can include subqueries against any accessible table.

Step 4 — Post-Exploitation Impact: Once the injection is confirmed and usable, the attacker can systematically extract:

• Patron PII including names, addresses, phone numbers, email addresses, and borrowing history.
• Staff account bcrypt password hashes from the staff users table, enabling offline password cracking and potential credential reuse attacks.
• Two-factor authentication secrets stored in the database, allowing the attacker to bypass 2FA for compromised staff accounts.

The attacker can achieve full database read access, effectively compromising the confidentiality of the entire Koha instance. The CVSS vector confirms high confidentiality impact (C:H) with low availability impact (A:L), meaning the attacker could potentially cause minor service degradation through malformed injection attempts.

Impact Assessment

CVSS Breakdown: The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L corresponds to a base score of 7.1 (High). Key indicators: network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L) meaning at least one staff account is needed, no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L).

Business Impact:

• Regulatory exposure: Libraries handling patron data are frequently subject to privacy regulations (e.g., GDPR in Europe, state-level library privacy laws in the US). Exfiltration of patron PII and borrowing histories constitutes a reportable data breach in many jurisdictions.
• Credential compromise: Exposure of staff bcrypt password hashes and 2FA secrets enables account takeover of library staff, including potentially higher-privileged administrative accounts if password reuse exists.
• Reputational damage: Public library systems are community-facing institutions; a data breach involving patron records would severely erode public trust.

Affected Systems: All Koha deployments running versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. This encompasses virtually every actively maintained Koha installation in production, as these version lines represent the current stable releases (24.11.x LTS, 25.05.x, 25.11.x, 26.05.x). The vendor/product field indicates "Koha / Unknown," suggesting uncertainty about which specific hosting variants or forks are also impacted.

Blast Radius: The vulnerability is confined to the Koha database (SQL injection reads from the same database instance), but the confidentiality impact extends to all data stored in that database — patron records, staff credentials, circulation history, acquisitions metadata, and potentially system configuration data.

Detection Guidance

Sigma Rule

title: Koha acqui/parcels.pl SQL Injection via orderby Parameter
id: e7f4a2c1-5b3d-4e8f-9a6c-1d2e3f4a5b6c
status: experimental
description: Detects time-based SQL injection attempts targeting the orderby parameter in Koha acqui/parcels.pl
logsource:
    category: webserver
    product: apache
    definition: Web server access logs or WAF logs for Koha staff interface
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - 'acqui/parcels.pl'
            - 'orderby='
    selection_sqli_patterns:
        cs-uri-query|contains|all:
            - 'sleep('
            - 'benchmark('
            - 'waitfor'
            - 'pg_sleep'
            - 'if('
            - 'substring('
            - 'ascii('
            - 'concat('
    selection_heavy_patterns:
        cs-uri-query|contains:
            - '%27'
            - '0x'
            - 'union'
            - 'select'
    condition: selection and (selection_sqli_patterns or selection_heavy_patterns)
    level: high
    falsepositives:
        - Legitimate URL-encoded query strings containing common SQL terms in unrelated parameters
    tags:
        - attack.t1190
        - cve.2026-72609
        - technique.t1190

YARA Rule

rule koha_parcels_sqli_orderby
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects HTTP requests targeting Koha acqui/parcels.pl with SQL injection patterns in orderby parameter"
        cve = "CVE-2026-72609"
        date = "2026-01-01"
        severity = "high"
    strings:
        $endpoint = "acqui/parcels.pl"
        $param = "orderby="
        $time_func = /(sleep|SLEEP|BENCHMARK|pg_sleep|waitfor|WAITFOR)[\s\S]{0,50}\(/ nocase
        $condition = /(if|IF)\s*\(/ nocase
        $query_keywords = /(union|select|substring|ascii|char|concat|information_schema|regexp)/ nocase
        $url_encoding = /(?:\%27(?:\%3D|\%3E|\%3C|\%29|\%28)|0x[0-9a-fA-F]{4,})/
    condition:
        $endpoint and $param and (#time_func >= 1 or (#condition >= 1 and #query_keywords >= 1) or #url_encoding >= 2)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Koha acqui/parcels.pl SQL Injection Attempt - orderby parameter"; flow:established,to_server; http.uri; content:"acqui/parcels.pl"; http.uri; content:"orderby="; nocase; content:"sleep("; nocase; http.uri; sid:2026072601; rev:1; metadata:created_at 2026-01-01, updated_at 2026-01-01, cve CVE-2026-72609, signature_severity Critical, attack_target Web_Server, deployment Perimeter, tag SQL_Injection, tag CVE-2026-72609; reference:url,valtersit.com/cve-2026-72609;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where dns.question.name : "*koha*" or network.protocol : "http" and url.path contains "acqui/parcels.pl"]
  [http where url.path contains "acqui/parcels.pl" and url.query contains "orderby=" and
   (url.query contains "sleep(" or url.query contains "benchmark(" or
    url.query contains "waitfor" or url.query contains "pg_sleep" or
    url.query contains "if(" and (url.query contains "substring" or url.query contains "ascii")) ]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*/acqui/parcels.pl" 
| where match(uri_query, "(?i)orderby=.*(sleep|benchmark|waitfor|pg_sleep|if\s*\()")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri uri_query status
| where count > 5
| eval alert = "Possible CVE-2026-72609 SQL injection attempt detected"
| table _time src_ip uri uri_query count status first_seen last_seen alert

Wazuh OSSEC Rule

<group name="koha,sqli,">
  <rule id="100726" level="12">
    <decoded>
      <match>allo</match>
    </decoded>
    <regex>acqui/parcels\.pl.*orderby=.*(?:sleep|benchmark|waitfor|pg_sleep)\(</regex>
    <description>Koha CVE-2026-72609: Time-based SQL injection attempt detected in orderby parameter of acqui/parcels.pl</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor (Koha Community) has not released a fixed version in any of the four affected branches (24.11.x, 25.05.x, 25.11.x, 26.05.x) as of this report.

Immediate Mitigations (No Patch Available):

1. Restrict the acquisition => order_receive permission to the minimum number of staff accounts necessary for operational needs. Audit current permission grants and remove this permission from accounts that do not actively perform order receiving tasks.
2. Limit network exposure of the staff interface. Place the Koha staff client (intranet) behind a VPN or IP-allowlisted access controls. Do not expose the staff interface directly to the public internet.
3. Enable and monitor database query logging (MySQL general query log or slow query log) to detect anomalous SELECT statements containing SLEEP(), BENCHMARK(), or subquery patterns originating from the web application user.
4. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns in the orderby parameter specifically, including time-based payload signatures.
5. Strengthen password hashing awareness: If exfiltration is suspected, force password resets for all staff accounts and revoke/reissue 2FA tokens.

Patch/Upgrade Steps:

• Monitor the Koha Community security announcements and the Koha git repository for a commit patching the direction-token validation in C4::Acquisition::GetInvoices.
• When a patched version is released, upgrade each affected branch (24.11.x, 25.05.x, 25.11.x, 26.05.x) to the version containing the fix.
• Test the upgrade in a staging environment before production deployment.

Long-Term Hardening:

1. Input validation at the controller layer: Ensure all parameters passed to SQL query building functions are validated for both structure and content, not just individual components (column name vs. direction token).
2. Parameterized queries: Refactor database access patterns to use prepared statements with bound parameters for all user-influenced values, eliminating raw string concatenation into SQL clauses.
3. Least-privilege database accounts: Configure the web application's database connection to use an account with only SELECT, INSERT, UPDATE, DELETE on required tables — and specifically deny SLEEP-facilitating privileges where possible (note: SLEEP() is generally available to any authenticated MySQL user, limiting this control's effectiveness).
4. Regular permission audits: Periodically review staff permission assignments in Koha to identify unnecessary grants.
5. Intrusion detection: Deploy the Sigma/YARA/Suricata rules provided above on perimeter and internal monitoring systems.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72609 — Official CVE record with CVSS vector and description.
2. CWE-89 Database: https://cwe.mitre.org/data/definitions/89.html — SQL Injection weakness category reference.
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-72609 is NOT listed in the KEV catalog (no known exploitation in the wild confirmed).
4. Koha Community Website: https://koha-community.org/ — Vendor site; monitor for security advisories and version release announcements.
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique reference used for correlation.

Threat Actor Intelligence: As of this report, there is no confirmed exploitation-in-the-wild evidence, no public PoC, no Nuclei template, and no exploit code available. The EPSS score of 0.00219 (12.6th percentile) indicates a relatively low probability of near-term exploitation in the wild, but this should not diminish the severity given the sensitivity of library database contents. Attackers targeting educational and municipal library systems (common targets for credential harvesting and PII theft) may weaponize this in the future once patch status crystallizes. Monitor KEV and vendor advisories for updates.