Database disclosure via unvalidated report dimensions

SQL injection in affected Koha versions allows remote authenticated users with reports permission to read database data. The calculate subroutine in reports/catalogue_stats.pl inserts the Line and Column parameters into SELECT, GROUP BY, and ORDER BY identifier positions without allowlist validation; a truthy cotedigits value is also concatenated into LEFT(). A staff account with the reports module permission is required, and injected SQL can expose any table readable by Koha's database account, including patron records, API keys, and sessions.