CVE-2026-71288 — Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI…¶

Key facts

CVE-2026-71288 is a High (8.8) vulnerability: Koha's guided report builder (reports/guided_reports.pl) reads the order_by CGI…. This entry ships a detection-only PoC and a Docker test lab.


CVE	CVE-2026-71288
Severity	High (8.8)
Detection / prevention	—
PoC	poc.py
Source	2026/CVE-2026-71288/

Details¶

English | 한국어

Description¶

Koha's guided report builder (reports/guided_reports.pl) reads the order_by CGI parameter and, for each value, a dynamically-named {order}_ovalue parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: my @order_by = $input->multi_param('order_by'); foreach my $order (@order_by) { my $value = $input->param($order . "_ovalue"); $query_orderby = " ORDER BY $order $value"; }. The resulting string is appended verbatim to the final query in C4::Reports::Guided ($query .= $orderby;) with no escaping. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist. Any staff account with the low-privilege create_reports or execute_reports permission (commonly granted to non-admin library staff) can perform time-based blind SQL injection against the Koha database, which stores patron PII and staff/LDAP credentials.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-71288
Type	SQLI
CVSS Score	8.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-71288/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-71288

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/Koha-Community/Koha
https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl

Generated by PoC Generator on 2026-08-09T18:23:28.612301699

Frequently asked questions¶

What is CVE-2026-71288?¶