CVE-2026-70369

8.8 HIGH

Published 2026-08-04 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows for SQL injection by directly interpolating user-controlled parameters into SQL queries, leading to potential data theft or system compromise.
Exploitability: Exploitation is relatively easy given direct parameter interpolation without proper sanitization or validation.
Blast radius: If exploited, it could result in unauthorized access to sensitive database information across the entire application's dataset.
Prioritized remediation: Implement input validation and parameterized queries to prevent SQL injection attacks.

sql-injectionrcewebsecurity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.