{"id":"CVE-2026-107081","kind":"vulnerability","aliases":["CVE-2026-107081"],"related":[],"title":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints…","description":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.","summary":"SLiMS Bulian 9.8.0 admin AJAX endpoints put the tableName and tableFields POST parameters straight into SQL identifiers (SELECT $fields FROM $table_name). Any logged-in staff account, whatever its role, can read any table, including admin password hashes. A public PoC exists. No fixed release exists as of 2026-10-23.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SLiMS (slims9_bulian)","fixed":[],"affected":"9.8.0","ecosystem":"other"}],"ecosystems":[],"tags":["library-systems","other","php","poc-public","self-hosted","slims","sql-injection"],"not_affected_if":["auth-required"],"how_to_check":"Run SLiMS 9.8.0 (check the version in the admin footer or the SLiMS version constant in sysconfig) and these files exist: admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php. Look in the web server logs for POSTs to those endpoints with tableName values containing SELECT or parentheses.","fix":"No patched release yet (unknown). Until one ships: restrict /admin to trusted IPs or a VPN, remove staff accounts you do not need, and rotate admin passwords if untrusted staff had access. As a stopgap, block POSTs to the three endpoints whose tableName or tableFields contain characters other than [A-Za-z0-9_:,] (WAF rule). Upstream's suggested fix is a whitelist of table and column names. Watch slims/slims9_bulian#391 and the releases page.","status":"open","published_at":"2026-10-19T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:04:44+00:00","updated_at":"2026-10-23T23:25:27+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:04:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","impact":"high","summary":"SENAYAN Library Management System (SLiMS) Bulian 9.8.0 has SQL injection in its admin AJAX endpoints through the tableName and tableFields POST parameters. Any authenticated staff user can extract arbitrary database contents.","category":"other","who_cares":["slims","php","self-hosted","library-systems"],"confidence":0.7,"needs_auth":"yes","worst_case":"Staff account reads entire database, including user credentials and patron data.","analyst_note":"Find the vendor patch or fixed version for SLiMS after 9.8.0 and the exact remediation steps; the NVD entry gives no fix or version range.","how_to_check":"Check whether the SLiMS version is 9.8.0 (Bulian). Look for admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php and admin/AJAX_vocabolary_control.php on the server. unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00077,"input_tokens":2802,"output_tokens":979,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor patch or fixed version for SLiMS after 9.8.0 and the exact remediation steps; the NVD entry gives no fix or version range.","search":"'-10':91B '-107081':19A,22A '-2026':18A,21A '-23':92B '2026':90B '9.8.0':43B,119C 'account':68B 'admin':14A,44B,77B,106C 'admin/ajax_check_id.php':110C 'admin/ajax_lookup_handler.php':109C 'admin/ajax_vocabolary_control.php':111C 'ajax':15A,45B,107C 'allow':120C 'arbitrari':127C 'authent':122C 'bulian':25A,42B,118C 'content':129C 'cve':17A,20A 'databas':128C 'endpoint':16A,46B,108C 'exist':83B,87B 'extract':126C 'field':59B 'fix':85B 'hash':79B 'host':36B 'identifi':4A,57B,96C 'includ':76B 'inject':2A,5A,40B,94C,97C 'librari':27B,114C 'library-system':26B 'log':65B 'logged-in':64B 'manag':115C 'name':62B 'paramet':12A,53B,104C 'password':78B 'php':30B 'poc':32B,82B 'poc-publ':31B 'post':11A,52B,103C 'public':33B,81B 'put':47B 'read':73B 'releas':86B 'role':71B 'select':58B 'self':35B 'self-host':34B 'senayan':113C 'slim':37B,41B,117C 'slims':23A 'slims9':24A 'sql':1A,39B,56B,93C 'sql-inject':38B 'staff':67B,123C 'straight':54B 'system':28B,116C 'tabl':61B,75B 'tablefield':10A,51B,102C 'tablenam':8A,49B,100C 'user':124C 'via':3A,95C 'whatev':69B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-107081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107081","severity":null,"published_at":"2026-10-19T16:17:01+00:00","modified_at":"2026-10-22T03:16:31+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107081:440","url":null,"severity":null,"published_at":"2026-10-23T23:25:27+00:00","modified_at":"2026-10-23T23:25:27+00:00","first_seen_at":"2026-10-23T23:25:27+00:00","fetched_at":"2026-10-23T23:25:27+00:00","note":"No vendor fix: issue #391 open since 2026-10-05 with no maintainer reply; latest release is v9.8.0 (24 Jun). Public PoC (Primandito, 2026-10-14) with ready-to-run requests. No exploitation reports found. NVD CVSS 9.8 says PR:N but the issue needs a staff login. Sibling CVEs 107082-107084 hit the same 9.8.0. Did not search X/HN."}],"documents":[{"id":1947,"url":"https://github.com/slims/slims9_bulian/issues/391","title":"SLiMS issue #391: SQLi via tableName/tableFields (open, no maintainer reply)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1948,"url":"https://github.com/Primandito/CVE-2026-107081","title":"Primandito write-up and PoC for CVE-2026-107081","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1949,"url":"https://github.com/slims/slims9_bulian/releases","title":"slims9_bulian releases (latest v9.8.0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}