CVE-2017-12585

High

Published: 06/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

SLiMS 8 Akasia versions up to 8.3.1 have SQL injection vulnerabilities in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.

Risk Assessment

This vulnerability may lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update SLiMS to the latest version and implement additional security measures, such as restricting access to critical files.

Other vulnerabilities in SLiMS 8 Akasia

CVE-2017-12584High
SLiMS 8 Akasia through version 8.3.1 lacks CSRF protections. This allows remote attackers to trick a user into changing to an attacker-controlled password, leading to complete account takeover.

Original NVD description (English source)

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS