SQL Injection in SENAYAN Library Management System Bulian

Executive Summary

CVE-2026-107081 is a SQL injection vulnerability in SLiMS 9.8.0 affecting admin AJAX endpoints. It occurs because user-controlled POST parameters tableName and tableFields are directly interpolated into SQL identifiers without validation or sanitization. Authenticated staff users can exploit this to extract arbitrary database contents, including admin password hashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability in SLiMS 9.8.0, check if authenticated staff users can access admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) and manipulate tableName or tableFields POST parameters. Test by sending crafted requests with SQL payloads like ' OR 1=1 -- to observe database errors or data leaks.

Useful 0 Not Useful 0

Impact Analysis

If you are an authenticated staff user of SLiMS 9.8.0, an attacker with your credentials could exploit this to steal sensitive data like admin password hashes, database versions, or other confidential information. Even low-privilege staff roles can perform these attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using SLiMS 9.8.0 may face compliance breaches, legal penalties, and reputational damage due to potential data leaks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SLiMS to a patched version if available. As a temporary fix, implement strict whitelisting for tableName and tableFields parameters, disable global admin sanitizer that disables SQL escaping, and ensure proper backtick quoting for identifiers. Disable admin AJAX endpoints if not essential.

Useful 0 Not Useful 0