SLiMS: SQL injection via identifier injection in admin AJAX endpoints

Summary

SLiMS 9.8.0 (Senayan Library Management System) is affected by an SQL injection in three admin AJAX endpoints. The tableName and tableFields POST parameters are inserted unvalidated into SQL table and column identifiers. Any authenticated staff account, regardless of role, can read arbitrary database content, including the user table with admin password hashes. Public proof-of-concept material exists.

Affected

• SLiMS 9.8.0 (master)
• Earlier and later versions: Unknown.

Fixed in

Unknown. No vendor fix or confirmed fixed version found.

Workaround

• Restrict access to /admin by IP address or place it behind a VPN.
• Remove unused staff accounts and limit accounts to the minimum needed.
• Use a database account with the least privileges the application needs.
• Monitor for unusual POST requests to admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php and admin/AJAX_vocabolary_control.php.
• Note: the vendor's proposed fix (whitelisting table and field names) is a code change and not an administrator setting.

Exploitation

• Public proof of concept: yes (third-party write-up).
• CISA SSVC: exploitation poc, automatable yes, technical impact total.
• In the wild: no evidence found; not listed in CISA KEV; EPSS under 1%.

Our recommendation

• Treat SLiMS 9.8.0 as unpatched until the vendor publishes a fix.
• Do not expose the SLiMS admin area to the internet.
• Check the SLiMS release page and the vendor issue for a fixed version and update promptly.
• Review staff accounts and reset passwords, especially admin, and consider the exposed hashes compromised.
• Monitor logs for unusual admin AJAX requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Primandito/CVE-2026-107081

Research sources

• CVE-2026-107081 GitHub write-up github.com
• SLiMS issue #391 (slims9_bulian) github.com
• SLiMS 9 Bulian releases github.com
• OpenCVE CVE-2026-107081 app.opencve.io
• Sploitus PoC entry sploitus.com
• SLiMS news slims.web.id

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:27.