CVE-2026-31844 Details
Description
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
A SQL injection vulnerability has been identified in the Koha staff interface, specifically within the 'displayby' parameter of the suggestions management script. This vulnerability allows low-privileged staff users to execute arbitrary SQL queries and access sensitive information from the database. The issue arises from inadequate validation and sanitization of user input, enabling the injection of malicious SQL that could be exploited to extract confidential data, such as password hashes, from the database.
The vulnerability has been fixed in Koha versions 26.05.00, 25.11.01, 25.05.07, and 24.11.12.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593 | TuranSec | Issue Tracking |
| https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/ | TuranSec | Not Applicable |
| https://koha-community.org/koha-25-11-01-released/ | TuranSec | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| koha koha | >= 24.11.0, < 24.11.12 >= 25.05.0, < 25.05.07 25.11.00 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Jun 17, 2026 | CVE Modified | TuranSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | CVE Modified | TuranSec |
| Mar 11, 2026 | New CVE Received | TuranSec |