CVE-2026-107082 Details
Description
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
A SQL injection vulnerability has been identified in SLiMS (Senayan Library Management System) version 9.8.0. This issue allows an authenticated staff user to exploit the 'opac_hide' and 'promoted' GET parameters in the 'admin/modules/bibliography/index.php' file. The vulnerability arises because the 'escape_string()' function is applied to these parameters, but the values are then concatenated into an unquoted numeric SQL context. This flaw enables the execution of arbitrary SQL commands, leading to error-based information disclosure and unauthorized data extraction.
Parameter values for numeric columns should be validated or cast to integers before being concatenated into SQL queries. Additionally, the 'escape_sql' function should be enabled for admin requests to provide an extra layer of protection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Primandito/CVE-2026-107082 | CISA-ADP | Technical Description |
| https://github.com/Primandito/CVE-2026-107082 | [email protected] | Technical Description |
| https://github.com/slims/slims9_bulian/issues/392 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Slims | 9.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |