An authenticated SQL injection vulnerability in the Koha staff interface poses a high risk of total database compromise for affected library management systems.

This is a SQL injection vulnerability (CWE-89) occurring in the /cgi-bin/koha/suggestion/suggestion.pl endpoint. It is triggered by improper validation of the displayby parameter within the GetDistinctValues functionality, requiring an authenticated user to initiate the exploit.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for a complete compromise of the backend database. Successful exploitation allows an authenticated attacker to read, modify, or delete sensitive library data, which could lead to significant operational disruption and the loss of confidential patron or administrative information.

Immediate Action: Upgrade to the latest patched version of Koha as specified in the vendor security advisory to remediate the vulnerable code.

Proactive Monitoring: Review database access logs for suspicious query patterns, particularly those targeting the suggestion management module or utilizing unexpected SQL syntax.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block SQL injection attempts directed at the /cgi-bin/koha/suggestion/ path.

Public Exploit Available: Unknown

Given the high CVSS score and the existence of a proof-of-concept, organizations running the affected versions of Koha must prioritize applying the provided vendor patches. Administrators should verify their current version against the affected list and perform the update immediately to prevent unauthorized database access and data integrity loss.