SLiMS 9 Bulian: Cross-site request forgery in loan history maintenance

Summary

Senayan Library Management System (SLiMS) 9 Bulian 9.8.0 allows cross-site request forgery against the loan history maintenance page. The action=run GET parameter performs destructive operations, including truncating the loan_history table, without a CSRF token or POST confirmation. An attacker can cause loss of loan history records by tricking a logged-in administrator into opening a crafted link.

Affected

• SLiMS 9 Bulian 9.8.0 (master)
• Component: admin/modules/circulation/loan_history_maintenance.php
• Earlier versions: Unknown.

Fixed in

Unknown. No official fixed version has been confirmed.

Workaround

• Back up the loan_history data before any change so that a truncation can be restored.
• Restrict access to the admin area and limit admin accounts to required staff.
• Log out of SLiMS when not in use and avoid opening untrusted links while logged in.
• Unofficial fork patch (awankumay/slims9_bulian PR #2) exists but is not an official release and must be regression-tested.

Exploitation

• Public proof-of-concept and write-up available.
• CISA SSVC: exploitation poc, automatable no, technical impact total.
• Not listed in CISA KEV; no known in-the-wild exploitation.

Our recommendation

• Back up the SLiMS database now, including loan_history.
• Check whether the SLiMS admin area is reachable from the internet and restrict access if it is.
• Limit admin accounts and warn admins not to click untrusted links while logged in.
• Monitor the upstream issue for an official fix and apply it as soon as it is released; test any patch first.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Primandito/CVE-2026-107084

Research sources

• Public write-up (Primandito) github.com
• Original report, SLiMS issue #394 github.com
• OpenCVE record app.opencve.io
• SLiMS releases github.com
• Unofficial fork patch PR #2 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:46.