---
id: "CVE-2026-107081"
kind: "vulnerability"
aliases: ["CVE-2026-107081"]
title: "SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "SLiMS (slims9_bulian)", "fixed": [], "affected": "9.8.0", "ecosystem": "other"}]
ecosystems: []
tags: ["library-systems", "other", "php", "poc-public", "self-hosted", "slims", "sql-injection"]
not_affected_if: ["auth-required"]
published_at: "2026-10-19T16:17:01+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-23T23:25:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107081", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:25:27+00:00"}]
---

# SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints…

SLiMS Bulian 9.8.0 admin AJAX endpoints put the tableName and tableFields POST parameters straight into SQL identifiers (SELECT $fields FROM $table_name). Any logged-in staff account, whatever its role, can read any table, including admin password hashes. A public PoC exists. No fixed release exists as of 2026-10-23.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:SLiMS (slims9_bulian) affected 9.8.0 fixed ?

## How to check

Run SLiMS 9.8.0 (check the version in the admin footer or the SLiMS version constant in sysconfig) and these files exist: admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php. Look in the web server logs for POSTs to those endpoints with tableName values containing SELECT or parentheses.

## Fix

No patched release yet (unknown). Until one ships: restrict /admin to trusted IPs or a VPN, remove staff accounts you do not need, and rotate admin passwords if untrusted staff had access. As a stopgap, block POSTs to the three endpoints whose tableName or tableFields contain characters other than [A-Za-z0-9_:,] (WAF rule). Upstream's suggested fix is a whitelist of table and column names. Watch slims/slims9_bulian#391 and the releases page.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107081
- 2026-10-23T23:25:27+00:00 analyst — No vendor fix: issue #391 open since 2026-10-05 with no maintainer reply; latest release is v9.8.0 (24 Jun). Public PoC (Primandito, 2026-10-14) with ready-to-run requests. No exploitation reports found. NVD CVSS 9.8 says PR:N but the issue needs a staff login. Sibling CVEs 107082-107084 hit the same 9.8.0. Did not search X/HN.

## Documents

- [advisory] SLiMS issue #391: SQLi via tableName/tableFields (open, no maintainer reply) https://github.com/slims/slims9_bulian/issues/391
- [mentions] slims9_bulian releases (latest v9.8.0) https://github.com/slims/slims9_bulian/releases
- [poc] Primandito write-up and PoC for CVE-2026-107081 https://github.com/Primandito/CVE-2026-107081

## From the sources

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_