CVE-2026-107083 in Senayan Library Management System
Summary
by MITRE • 10/19/2026
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The SENAYAN Library Management System, specifically version 9.8.0 utilizing the Bulian theme, contains a critical security flaw within its administrative reporting module that allows for unauthorized database manipulation. This vulnerability is located in the dl_detail.php script under the admin/modules/reporting/customs directory and is triggered by improper handling of the fileID parameter. As an open-source library management solution widely deployed in educational institutions across Indonesia and other regions, SLiMS serves as a central repository for bibliographic data, patron information, and circulation records. The presence of this flaw exposes sensitive institutional data to potential compromise, undermining the integrity and confidentiality expected from such systems.
The technical root cause of this vulnerability is a classic SQL injection error resulting from insufficient input validation or sanitization on the fileID parameter before it is incorporated into an SQL query statement. When an attacker submits a specially crafted value for fileID, the application fails to properly escape special characters or enforce strict type checking. This allows malicious SQL code to be injected directly into the backend database engine. The vulnerability likely occurs during data retrieval operations where the system attempts to fetch details related to a specific report file based on its identifier. Because the input is treated as executable code rather than literal data, an attacker can manipulate the query structure to extract unauthorized information or alter existing records.
The operational impact of this SQL injection vector is severe and multifaceted. An authenticated administrator with access to the reporting module could potentially be bypassed if the vulnerability exists in a publicly accessible endpoint or if session management is flawed, though typically such modules require authentication. However, even within an authenticated context, the ability to inject arbitrary SQL commands allows for extensive data exfiltration. Attackers can dump entire database tables containing user credentials, personal identifiable information of library patrons, and internal administrative logs. Furthermore, depending on the underlying Database Management System configuration, this vulnerability could potentially be chained with other techniques to achieve remote code execution or complete system compromise by writing shell files to disk or executing operating system commands through stored procedures.
This flaw aligns directly with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. From a threat modeling perspective consistent with the MITRE ATT&CK framework, this vulnerability facilitates techniques categorized under Data Exfiltration and potentially Credential Access if password hashes are retrieved. The lack of parameterized queries or prepared statements represents a fundamental deviation from secure coding standards recommended by OWASP for web application development. Organizations relying on SLiMS 9.8.0 face significant risk to their data governance policies due to this unpatched entry point in the administrative interface.
Mitigation strategies must focus on immediate remediation of the codebase and broader security hardening measures. The primary fix involves modifying the dl_detail.php file to implement parameterized queries or prepared statements for all database interactions involving user-supplied input, ensuring that data is never interpreted as executable SQL syntax. Input validation should also be enforced by strictly defining expected formats for the fileID parameter, such as restricting it to integer values only using server-side type casting. Additionally, deploying a Web Application Firewall can provide temporary protection by filtering malicious payloads before they reach the application logic until the code patch is applied. Regular security audits and penetration testing are recommended to identify similar vulnerabilities in other modules of the SLiMS ecosystem that may share this coding pattern.