This vulnerability is a classic SQL injection flaw that occurs when an authenticated staff user can supply arbitrary values in the tableName and tableFields POST parameters to several admin AJAX endpoints. By injecting malicious SQL fragments, the attacker can manipulate the query generation and extract any data from the database, thereby compromising confidentiality. The weakness is a form of uncontrolled input use in SQL statements.

The affected product is the SENAYAN Library Management System (SLiMS) Bulian version 9.8.0. The flaw is present in several admin AJAX handler scripts that operate under staff user authentication.

Because the attack requires only that the user be an authenticated staff member, the risk is high for environments where staff have full administrative privileges. The exploit does not require external network access beyond normal authentication, making it feasible for any staff user to extract arbitrary data. The CVSS score is 9.8, and the EPSS score is less than 1%, indicating a low short‑term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the authenticated web application where the parameters are directly inserted into a SQL command without proper sanitization.