SLiMS 9.8.0 SQL injection leaks admin data (CVE-2026-107083) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-107083 is a critical unauthenticated SQL injection in SENAYAN Library Management System (SLiMS) Bulian 9.8.0, reachable through the fileID parameter in admin/modules/reporting/customs/dl_detail.php, that lets an attacker read and manipulate the library’s database, including staff credentials and member records. Fixed versions have not been published for 9.8.0; apply the mitigations below until an upgrade is available.

Overview

SLiMS powers the catalog, circulation, and membership systems of thousands of school, university, and public libraries, most of them run by small IT teams. The vulnerable script lives in the reporting module’s custom download handler, which takes the fileID parameter straight into a database query without sanitization. The CVSS vector is 9.8: network reachable, low complexity, no privileges required, no user interaction. In practice that means anyone who can reach the web server can trigger the injection with a crafted HTTP request.

It is worth noting the reachability nuance that drives real-world risk. The file sits under the admin/ path, which many deployments protect with directory rules or IP allowlists at the reverse proxy. Where those controls exist, the effective attack surface shrinks. Where SLiMS is exposed on a flat network or the internet without a proxy, this is directly exploitable by an unauthenticated party.

Impact

A successful injection gives the attacker a database session with the privileges of the SLiMS application account. That typically means:

• Dumping staff usernames and password hashes, enabling login as a librarian or administrator
• Reading member personally identifiable information: names, addresses, contact details, loan history
• Modifying or deleting catalog and circulation records, corrupting library operations
• Using the database account to probe for further access, including file read or write if the DB user is over-privileged

Because library systems hold PII for students and the public, this is a data protection concern as well as an availability one. If you have evidence the endpoint was probed, check breach reports and track follow-up coverage in security news.

Patch Guide and Mitigations

1. Upgrade: track the SLiMS project for the first Bulian release after 9.8.0 that includes the fix, and test it in staging before production rollout.
2. Restrict access: block external access to /admin/ at the reverse proxy. If reporting downloads must be reachable, allowlist staff IP ranges only.
3. Add a WAF rule: reject requests to dl_detail.php where fileID contains non-numeric characters. This breaks the injection without touching application code.
4. Harden the database account: give the SLiMS DB user read/write on its own schema only, no FILE privilege, no cross-database access. This limits blast radius if injection succeeds.
5. Rotate secrets: if the endpoint was exposed, rotate staff passwords and review application logs for encoded SQL payloads.

Security Insight

Legacy PHP library systems rarely receive the audit attention of commercial software, yet they hold some of the most sensitive PII an institution manages. A CVSS 9.8 with no privileges required suggests the input handling in this module was never reviewed against modern standards, which raises the question of what else in the reporting code path shares the same pattern. Institutions running SLiMS should treat this as a prompt for a broader review, not a single patch.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs