CVE-2026-107084: CSRF
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data loss of loan history records.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Administrators of SLiMS 9 Bulian 9.8.0 are exposed if they can be induced to load a crafted request while authenticated. The affected endpoint is under the admin circulation module.
What does an attacker need to exploit it?
An attacker needs to cause an authenticated administrator's browser to send a request to the loan history maintenance endpoint with the action=run GET parameter. No CSRF token or POST confirmation is required for the destructive action.
What is the impact of successful exploitation?
Successful exploitation can cause data loss by performing destructive operations on loan history records.