SLiMS Bulian: SQL injection in reporting module via fileID parameter

Summary

SENAYAN Library Management System (SLiMS) Bulian 9.8.0 contains an SQL injection flaw in admin/modules/reporting/customs/dl_detail.php. The fileID parameter is concatenated into an SQL query without quoting or integer casting, and only escape_string() is applied, which does not stop quote-free payloads. A public proof of concept exists, and the CVSS score of 9.8 assumes no privileges are required; the researcher describes it as requiring a valid staff login. An attacker who reaches the vulnerable endpoint could read, modify or delete library database content.

Affected

• SLiMS Bulian (slims9_bulian) 9.8.0
• Component: admin/modules/reporting/customs/dl_detail.php (parameter fileID)
• Note: the researcher also reports admin/modules/serial_control/subscription.php (itemID); this is not confirmed under this CVE ID.

Fixed in

Unknown. No fixed version or vendor advisory found.

Workaround

• Restrict access to the SLiMS admin area to internal networks or VPN.
• Use a web application firewall to detect and block SQL injection attempts; this is a stopgap, not a fix.
• Apply the reporter's suggested fix locally: cast fileID to an integer before it is used in SQL.

Exploitation

• Public proof of concept: yes (third-party GitHub repository).
• CISA SSVC: exploitation 'poc', automatable 'yes', technical impact 'total'.
• Known exploited (KEV): no.
• In the wild: no reports found.
• Authentication: disputed; NVD vector shows no privileges required, the researcher states a valid staff account is required.

Our recommendation

• Check whether SLiMS is reachable from the internet and restrict the admin area to internal networks or VPN.
• Enforce strong, unique staff passwords and multi-factor authentication where possible.
• Review web and database logs for unusual requests to the reporting module.
• Apply the vendor fix as soon as it is published, and watch the upstream issue for updates.
• Consider the priority high if the system is internet-facing or staff accounts are weakly protected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Primandito/CVE-2026-107083

Research sources

• GitHub: Primandito/CVE-2026-107083 (write-up and PoC) github.com
• SLiMS issue #393 (upstream report) github.com
• VulnCheck/Vulnrichment (CISA SSVC data) vulners.com
• OpenCVE: CVE-2026-107083 app.opencve.io
• SLiMS 9.8.0 release github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:25.