Description
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
Published: 2026-10-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Error-based SQL injection enabling data disclosure and arbitrary extraction
Action: Apply patch
AI Analysis

Impact

An authenticated staff user can inject arbitrary SQL through the opac_hide and promoted GET parameters in the bibliography module. The injection occurs because escape_string() is applied but the user input is concatenated into an unquoted numeric SQL context, allowing error-based information disclosure and extraction of sensitive data such as library catalog details and possibly account information.

Affected Systems

The vulnerability is present in Slims (Senayan Library Management Systems) 9 Bulian version 9.8.0, affecting the admin/modules/bibliography/index.php module accessed by staff users.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, while the CVSS score of 8.8 indicates high severity. Attackers would need valid staff credentials and access to the web interface to craft malicious GET requests such as ?opac_hide=xx or ?promoted=xx to trigger the injection. Successful exploitation can lead to the disclosure of internal database content and arbitrary data extraction, threatening confidentiality and potentially integrity of library records.

Generated by OpenCVE AI on October 20, 2026 at 19:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Use parameterized queries or prepared statements to ensure user input is treated as data, not executable SQL.
  • Validate and sanitize the opac_hide and promoted parameters, ensuring numeric values are properly cast before inclusion in SQL.
  • Restrict the module to authenticated users with the minimum privileges necessary, and consider removing or disabling the vulnerable GET parameters.
  • Apply any vendor–provided patch or upgrade Slims to a newer version where the issue is fixed.
  • If a patch is unavailable, temporarily block or filter the vulnerable parameters at the web server level to prevent exploitation.

Generated by OpenCVE AI on October 20, 2026 at 19:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Slims
Slims slims 9 Bulian
Vendors & Products Slims
Slims slims 9 Bulian

Tue, 20 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Title Authenticated SQL Injection in Slims Bibliography Module via GET Parameters

Tue, 20 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Title Authenticated SQL Injection in Slims Bibliography Module via GET Parameters
Weaknesses CWE-89

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
References

Subscriptions

Slims Slims 9 Bulian
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-20T16:06:59.546Z

Reserved: 2026-10-07T00:00:00.000Z

Link: CVE-2026-107082

cve-icon Vulnrichment

Updated: 2026-10-20T16:06:21.300Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T17:17:00.543

Modified: 2026-10-20T17:17:28.100

Link: CVE-2026-107082

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T17:01:40Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')