CVE-2026-107082
UnknownSummary
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
Risk Assessment
An authenticated staff user can exploit the vulnerability to extract arbitrary database data, posing a risk to the confidentiality and integrity of the system.
Recommendation
Update SLiMS to a patched version or apply the vendor fix; until then, restrict staff privileges and monitor for suspicious queries.
Other vulnerabilities in SLiMS
See all- CVE-2026-107081Unknown
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints in SLiMS Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
- CVE-2026-107083Critical
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
- CVE-2025-65233Medium
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF'] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Original NVD description (English source)
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS