CVE-2026-31844

Authenticated SQL Injection in Koha displayby parameter of suggestion.pl

State: Published
Severity: 8.7 High
Published: Mar 11, 2026
Updated: Aug 10, 2026
Reserved: Mar 9, 2026

Description

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	TuranSec
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	TuranSec
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C	TuranSec

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
KohaKoha Community	24.11.0 through 24.11.12Affected 25.05.0 through 25.05.07Affected 25.11.0 through 25.11.01Affected

References

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593issue-tracking
https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/vendor-advisory
https://koha-community.org/koha-25-11-01-released/release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.