SLiMS 9 Bulian: SQL injection in admin bibliography module

Summary

SLiMS 9 Bulian 9.8.0 contains an SQL injection flaw in the admin bibliography module via the opac_hide and promoted GET parameters. The values are only escaped, not validated, and are placed unquoted into a numeric SQL context, so escaping does not prevent injection. An authenticated staff user with any role can read database contents through error-based and UNION-based extraction, which may include patron personal data.

Affected

• SLiMS 9.8.0 (master), as reported
• Other versions: Unknown.

Fixed in

Unknown. No fixed version has been published at the time of writing.

Workaround

• Restrict access to the admin panel (admin/) to management workstations or a VPN.
• Remove unused staff accounts and enforce least privilege for staff roles.
• Run the database account with minimal rights and disable verbose database error output.

Exploitation

• Public proof of concept available (GitHub write-up, CISA SSVC: Exploitation poc, Automatable no).
• Exploitation in the wild: Unknown.
• Requires a valid staff login; attack vector is network.

Our recommendation

• Check whether any SLiMS 9.8.0 instance exists and whether its admin panel is reachable from the internet; restrict access if it is.
• Apply the access restrictions and staff account hygiene now.
• Monitor the vendor issue and releases for a fix, then upgrade and verify.
• Review database and web server logs for XPATH syntax errors or unusual admin requests with opac_hide or promoted parameters.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Primandito/CVE-2026-107082

Research sources

• Primandito/CVE-2026-107082 write-up github.com
• slims/slims9_bulian issue #392 github.com
• OpenCVE CVE-2026-107082 app.opencve.io
• VulDB 422437 vuldb.com
• SLiMS 9 Bulian releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:50.