High
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
Type: advisorySources: OSV
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-31844
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 04:27 UTC · Revision 1
Source evidence
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
core-osv · Original sourcePublished 11 Mar 2026, 06:34 UTC
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
osv:CVE-2026-31844
Complete source record
{
"id": "d74a726404a8a8b12dec0ef56b03cf8bf2dc17bfc9759b925d44bfc602b3768d",
"url": "https://osv.dev/vulnerability/CVE-2026-31844",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Authenticated SQL Injection in Koha displayby parameter of suggestion.pl",
"summary": "An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.",
"evidence": "osv:CVE-2026-31844",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-31844",
"aliases": [
"CVE-2026-31844"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/koha-community/koha",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5b7a05b4dbd9219a33eaa709103189f93163bf97"
},
{
"fixed": "87a3a54768a2b324fdc0c16b5623d092fac7652a"
},
{
"introduced": "3f2987eb19f7ac1987591d8e9b01961c39405b39"
},
{
"last_affected": "3f2987eb19f7ac1987591d8e9b01961c39405b39"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "24.11.0"
},
{
"fixed": "24.11.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "25.05.0"
},
{
"fixed": "25.05.07"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:koha:koha:25.11.00:*:*:*:*:*:*:*",
"range": [
{
"introduced": "25.11.00"
},
{
"last_affected": "25.11.00"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"25.11.00",
"v25.05.06-2",
"v24.11.11-2",
"v25.11.00",
"v24.11.11-1",
"v25.05.05-2",
"v25.05.05-1",
"v24.11.10-2",
"v25.05.04-1",
"v24.11.09-1",
"v24.11.08-3",
"v25.05.03-1",
"v24.11.08-2",
"v24.11.08-1",
"v25.05.02-2",
"v25.05.02-1",
"v24.11.07-1",
"v25.05.01-1",
"v24.11.06-1",
"v24.11.05-1",
"v25.05.00-1",
"v24.11.04-1",
"v24.11.03-3",
"v24.11.03-2",
"v24.11.02-1",
"v24.11.01",
"v24.11.00",
"v24.05.00",
"v23.11.00",
"v23.05.00",
"v22.11.00",
"v22.05.00",
"v21.11.00",
"v21.05.00",
"v20.11.00",
"v20.05.00",
"v19.11.00",
"v19.05.00",
"v18.11.00",
"v18.05.00",
"v18.05.00-rc1",
"v17.11.00",
"v17.05.00",
"v16.11.00",
"v16.05.00",
"v16.05.00-beta",
"v3.22.00",
"v3.22.00-beta",
"v3.20.00",
"v3.20.00-beta",
"v3.18.00",
"v3.18.00-beta",
"v3.16.00",
"v3.16.00-rc",
"v3.16.00-beta",
"v3.14.00-beta",
"v3.14.00-alpha2",
"v3.14.00-alpha1",
"v3.12.00-beta1",
"v3.12.00-alpha2",
"v3.12.00-alpha",
"v3.08.00",
"v3.04.00",
"v3.02.00-beta",
"v3.02.00-alpha2",
"v3.02.00-alpha",
"v3.00.00",
"v3.00.00-stableRC1",
"v3.00.00-beta2",
"v3.00.00-beta",
"v3.00.00-alpha",
"R_2-4",
"R_2-1",
"R_2-0-0RC1",
"R_2-0-0pre5",
"R_2-0-0pre4",
"R_2-0-0pre3",
"R_2-0-0pre2",
"R_2-0-0pre1",
"R_1-9-3",
"R_1-9-2",
"R_1-9-1",
"R_1-9-0",
"R_1-3-3",
"R_1-3-2",
"R_1-3-1",
"R_1-3-0",
"R_1-2-2RC4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31844.json"
}
}
],
"modified": "2026-10-28T02:30:49.650832027Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31844.json",
"https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/",
"https://koha-community.org/koha-25-11-01-released/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-31844",
"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593"
],
"provider_metadata": {
"cwe_ids": [
"CWE-89"
],
"cna_assigner": "TuranSec",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "24.11.0"
},
{
"last_affected": "24.11.12"
},
{
"introduced": "25.05.0"
},
{
"last_affected": "25.05.07"
},
{
"introduced": "25.11.0"
},
{
"last_affected": "25.11.01"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31844.json"
}
},
"related_cves": [
{
"value": "CVE-2026-31844",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518123,
"published_at": "2026-03-11T06:34:14.869+00:00"
}