The bug allows privileged destructive operations to be performed by the action=run GET parameter on the admin/modules/circulation/loan_history_maintenance.php page. The module performs the operation with no CSRF token or POST confirmation, meaning an attacker can delete or corrupt loan history records simply by causing an authenticated administrator to visit a crafted URL. This flaw demonstrates an improper control of the authentication token or access control, identified as CWE‑352.

The affected system is Slims (Senayan Library Management Systems) 9 Bulian, version 9.8.0. All installations of this build that deploy the admin circulation loan history maintenance module are susceptible.

The vulnerability carries a high data integrity risk, with a CVSS score of 8.8, because it allows unauthorized deletion of critical loan history data. Requesting the action=run GET parameter does not require confirmation or a POST request, so the exploit is straightforward. Based on the description, it is inferred that the attack vector is a crafted link or script that forces an administrator’s browser to request this URL while an authenticated session is active; the EPSS score is <1%, and the issue is not listed in CISA’s KEV catalog, but the absence of CSRF protection coupled with the destructive nature means exploitation would be simple for a threat actor who can reach an admin account.