SQL Injection in SENAYAN SLiMS Bulian

Executive Summary

CVE-2026-107083 is a SQL Injection vulnerability in SLiMS 9.8.0 affecting two admin modules: subscription.php and dl_detail.php. The issue occurs because user-supplied input is directly concatenated into SQL queries without proper sanitization or integer casting. Attackers can exploit this by sending crafted requests to inject malicious SQL payloads, such as extracting database version information.

Useful 0 Not Useful 0

Detection Guidance

To detect SQL injection vulnerabilities in SLiMS 9.8.0, inspect admin modules reporting/customs/dl_detail.php and serial_control/subscription.php for unquoted numeric concatenation in SQL queries. Check if user inputs like fileID or itemID are directly concatenated without proper sanitization or integer casting. Test with payloads such as 0 AND EXTRACTVALUE(1,CONCAT(0x7e,version())) to observe error messages revealing database details.

• Use SQL error-based techniques to trigger database errors and confirm vulnerability presence.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows authenticated staff users to perform SQL Injection attacks. Attackers could extract sensitive database information, manipulate data, or gain unauthorized access to the system. The impact includes data breaches, unauthorized modifications, and potential system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to sensitive personal data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, triggering regulatory penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SLiMS to a patched version or apply the recommended fix by casting numeric parameters to integers before SQL concatenation, e.g., (int)$_POST['itemID'][0]. Disable admin-side sanitizer configurations that bypass escape_sql for admin requests. Validate and sanitize all user inputs strictly in both subscription.php and dl_detail.php modules.

Useful 0 Not Useful 0