CVE-2026-107082: SQL Injection
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opachide and promoted GET parameters of admin/modules/bibliography/index.php, because escapestring() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to authenticate as a SLiMS staff user. The issue is in the administrative bibliography module, so unauthenticated public OPAC visitors are not described as able to exploit it.
Which inputs are affected?
The affected inputs are the opac_hide and promoted GET parameters handled by admin/modules/bibliography/index.php. They are inserted into an unquoted numeric SQL context despite processing with escape_string().
What is the impact of successful exploitation?
Successful exploitation can produce database errors that disclose information and can allow arbitrary data extraction through error-based SQL injection.