{"id":"CVE-2026-107082","kind":"vulnerability","aliases":["CVE-2026-107082"],"related":[],"title":"Slims library system: staff SQL injection exposes database contents","description":"Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.","summary":"SLiMS 9.8.0 admin bibliography page (admin/modules/bibliography/index.php) concatenates opac_hide and promoted GET parameters unquoted into SQL after escape_string(), which does nothing for quote-free payloads. Any logged-in staff account, whatever its role, can extract database contents (error-based/UNION). There is a public PoC. No fixed release exists yet.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"slims9_bulian","fixed":[],"affected":"9.8.0","ecosystem":"php"}],"ecosystems":[],"tags":["library-systems","package","php","self-hosted","slims","sql-injection"],"not_affected_if":["auth-required","no-staff-accounts","not-version-9.8.0"],"how_to_check":"Check your version in the admin footer or system info; 9.8.0 is affected. In code, look at admin/modules/bibliography/index.php around lines 1352-1360 for \"AND opac_hide =\" . $opac_hide without an int cast. Check web logs for requests to the bibliography index.php with opac_hide or promoted values that are not 0 or 1 (EXTRACTVALUE, UNION, SELECT).","fix":"No patched release yet; latest is 9.8.0. Workaround: cast the values with (int) or allow only 0/1 before concatenating (opac_hide and promoted), as in the reporter's recommendation. Also set the first escape_sql filter in admin/default/session.inc.php:35 to true. Limit staff accounts, restrict /admin by IP or VPN, and watch upstream issue #392 for a fix.","status":"open","published_at":"2026-10-19T17:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:33:09+00:00","updated_at":"2026-10-24T00:21:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:33:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Slims library system: staff SQL injection exposes database contents","impact":"high","summary":"Slims 9 Bulian 9.8.0, a library management system, lets a logged-in staff user inject SQL through the opac_hide and promoted GET parameters of the bibliography admin page. An attacker can read arbitrary database data through error-based extraction.","category":"package","who_cares":["slims","self-hosted","library-systems","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Staff attacker reads arbitrary database tables, including member and admin credentials.","analyst_note":"Find the vendor fix version and advisory for CVE-2026-107082 in the NVD entry or the Slims project repository; sources give no patched version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","not-version-9.8.0"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000472,"input_tokens":2953,"output_tokens":354,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor fix version and advisory for CVE-2026-107082 in the NVD entry or the Slims project repository; sources give no patched version.","search":"'-107082':12A,15A '-2026':11A,14A '/union':73B '9':89C '9.8.0':31B,91C 'account':62B 'admin':32B 'admin/modules/bibliography/index.php':35B,110C 'allow':92C 'appli':115C 'arbitrari':135C 'authent':94C 'base':72B,131C 'bibliographi':33B 'bulian':17A,90C 'concaten':36B,120C 'content':9A,69B 'context':126C 'cve':10A,13A 'data':136C 'databas':8A,68B 'disclosur':133C 'error':71B,130C 'error-bas':70B,129C 'escap':47B,112C 'exist':82B 'expos':7A 'extract':67B,137C 'fix':80B 'free':55B 'get':41B,107C 'hide':38B,104C 'host':25B 'inform':132C 'inject':6A,29B,100C 'lead':127C 'librari':2A,19B,86C 'library-system':18B 'log':59B 'logged-in':58B 'manag':87C 'noth':51B 'numer':124C 'opac':37B,103C 'packag':21B 'page':34B 'paramet':42B,108C 'payload':56B 'perform':98C 'php':22B 'poc':78B 'promot':40B,106C 'public':77B 'quot':54B 'quote-fre':53B 'releas':81B 'role':65B 'self':24B 'self-host':23B 'senayan':85C 'slim':1A,26B,30B,84C 'slims9':16A 'sql':5A,28B,45B,99C,125C 'sql-inject':27B 'staff':4A,61B,95C 'string':48B,113C 'system':3A,20B,88C 'unquot':43B,123C 'user':96C 'valu':118C 'via':101C 'whatev':63B 'yet':83B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-107082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107082","severity":null,"published_at":"2026-10-19T17:17:00+00:00","modified_at":"2026-10-20T17:17:28+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107082:644","url":null,"severity":null,"published_at":"2026-10-24T00:21:31+00:00","modified_at":"2026-10-24T00:21:31+00:00","first_seen_at":"2026-10-24T00:21:31+00:00","fetched_at":"2026-10-24T00:21:31+00:00","note":"No vendor fix found: upstream issue #392 (reported 2026-10-05) is open with no maintainer reply, latest release is v9.8.0 (the affected one). Public PoC by reporter. Feedly's 'Patched' flag is unverified. Did not search X/Bluesky."}],"documents":[{"id":2557,"url":"https://github.com/slims/slims9_bulian/issues/392","title":"slims9_bulian #392: SQLi via opac_hide/promoted (open, no maintainer reply)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2558,"url":"https://github.com/Primandito/CVE-2026-107082","title":"Primandito PoC write-up CVE-2026-107082","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1949,"url":"https://github.com/slims/slims9_bulian/releases","title":"slims9_bulian releases (latest v9.8.0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2560,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107082","title":"CVE record CVE-2026-107082","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}