The SLiMS Bulian 9.8.0 application contains an unsanitized fileID parameter in the admin/modules/reporting/customs/dl_detail.php reporting endpoint, allowing attackers to inject arbitrary SQL. This flaw can be used to read, modify, or delete records in the underlying database, potentially exposing sensitive library information and compromising system integrity. The weakness corresponds to CWE‑89 (SQL Injection).

SLiMS Bulian 9.8.0, developed by the Senayan Library Management System community, is affected. The vulnerability manifests in the file admin/modules/reporting/customs/dl_detail.php and is accessed via the web interface.

No CVSS score or EPSS rating is provided, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to interact with the web interface remotely, likely through a network connection to the SLiMS server. While no public exploit code exists, the potential for data exposure and database compromise is high, making the risk significant if the vulnerability is exploited.