SQL Injection in SLiMS 9 Bulian 9.8.0

Executive Summary

CVE-2026-107082 is a SQL injection flaw in SLiMS 9.8.0's admin bibliography module. The vulnerability occurs in the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php. An authenticated staff user can inject malicious SQL payloads through these parameters because the application concatenates user input directly into SQL queries without proper sanitization. The escape_string() function used does not prevent quote-free SQL injection in numeric contexts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SLiMS 9.8.0 installation uses the affected admin/modules/bibliography/index.php file with opac_hide or promoted GET parameters. Test by appending malicious SQL payloads like opac_hide=1 AND 1=CONVERT(int,(SELECT@@version)) to the URL and observe if database errors or version information is returned.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated staff user to perform error-based and UNION-based data extraction attacks. Exploitation can leak database version, user context, or execute arbitrary subqueries. Attackers may extract sensitive data from the database, modify or delete records, or gain unauthorized access to the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SLiMS to a patched version that validates opac_hide and promoted parameters as integers or restricts them to 0/1. If an update is unavailable, apply input validation in admin/modules/bibliography/index.php to cast these parameters to integers before SQL concatenation.

Useful 0 Not Useful 0