This SQL injection in Koha's reporting module is more severe than the CVSS 8.8 score suggests, and the reason cuts to the heart of how this vulnerability becomes catastrophic rather than merely dangerous.
The technical flaw: the 'Criteria' parameter accepts table-name prefix normalization but performs no whitelisting of identifiers. This enables injection in ORDER BY, GROUP BY, and similar positions where SQL expects column names. Worse, the same file contains two additional injection vectors — Filter values inject in literal positions, and the Limit parameter injects directly. All three positions stem from the same unsafe pattern: raw string concatenation rather than parameterized queries.
What makes this a detonation event rather than a footnote is the permission model. The 'reports module permission' required to exploit this isn't a restricted DBA role — it's routinely granted to circulation clerks, interlibrary loan staff, and branch managers. These are frontline workers using a reporting interface, not database administrators. The vulnerability effectively grants SQL construction capabilities to anyone who can log into the interlibrary loan workstation.
The blast radius is the second critical factor. The database accessible through this injection includes two-factor authentication secrets stored in the borrower records. This transforms the vulnerability from data exfiltration into complete authentication bypass: even institutions that implemented 2FA have that second factor compromised if they allow this permission. The credentials table exposure means this isn't a 'reporting module' vulnerability — it's an authentication architecture failure that depends on this module staying secure.
The patch must be applied urgently, but verify it covers all three injection positions — past CVE responses have sometimes fixed one parameter while leaving siblings unaddressed. Beyond the code fix, the operational remediation is significant: any institution where this permission was available should plan for mandatory 2FA re-enrollment, not just patching. The gap between 'patch available' and 'institutions actually patched' is where exploitation will occur, and the broad permission model means the attack surface includes disgruntled staff with legitimate credentials and browser access.