External risk intelligence

SLiMS Bulian 9.8.0 Identifier Injection Leads to Database Extraction.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-107081

The vulnerability exists in an admin-facing component of a Library Management System. Such systems are commonly deployed as web applications intended to be accessed over a network by administrative staff. While the vulnerability requires authentication, the product role as a management system often results in these interfaces being reachable via the public internet or an organization's broad internal network.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the SENAYAN Library Management System (SLiMS) could allow authenticated staff users to access sensitive database information. This issue stems from a SQL injection flaw within specific administrative functions. The potential for broad data extraction highlights the need to understand the presence and exposure of this system within the organization.

Staff can access any database information.
It affects a widely used library management system.
Confirm system relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with staff credentials could exploit this vulnerability by sending specially crafted requests to administrative AJAX endpoints. These requests would manipulate the `tableName` and `tableFields` parameters, leading to SQL injection. If successful, this could allow the attacker to access sensitive information from the system's database.

Authenticated staff user access required.
POST parameters in AJAX endpoints.
Allows arbitrary database content extraction.

Live Threat

Current exploitation, exposure, and threat context

Authenticated staff users could extract arbitrary database contents from the SENAYAN Library Management System (SLiMS) Bulian by injecting SQL code through specific POST parameters. This vulnerability affects admin AJAX endpoints when accessed by authorized users.

Database contents are at risk.
SQL injection via POST parameters.
Arbitrary data extraction is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SENAYAN Library Management System (SLiMS) Bulian administrative AJAX endpoints are vulnerable to SQL injection, allowing authenticated staff to extract arbitrary database contents. Since the system is designed for administrative staff and often deployed as a web application, the first practical step is for the application or infrastructure team to identify all SLiMS instances, confirm network reachability and business criticality, and then assign ownership for remediation planning.

Application or Infrastructure team ownership.
Verify SLiMS instance reachability and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SENAYAN Library Management System (SLiMS)?

SLiMS is an open-source software platform used by libraries and archives to manage collections, track circulation, and organize catalog data. It functions as a web-based management system where staff interact with a central database to perform routine administrative tasks, such as updating records or controlling vocabulary.

How does CVE-2026-107081 work as a SQL injection?

This vulnerability falls under the Improper Neutralization of Special Elements used in an SQL Command weakness class (CWE-89). It occurs because the software improperly handles inputs in administrative AJAX endpoints. By manipulating specific POST parameters, an attacker can append malicious SQL code to database queries, forcing the system to reveal unauthorized information.

Do I need to be an administrator to trigger this flaw?

Yes, successful exploitation requires authenticated staff access. The vulnerability is triggered by sending specially crafted POST requests to specific administrative AJAX handlers. It is not triggered by public users or unauthenticated visitors; the attacker must already possess valid credentials to access these internal management functions.

Why is this system considered an external-facing risk?

According to Halo Surface Signal, this software is often deployed as a web application intended for broad network access. Because library management interfaces frequently reside on organization-wide networks or are made reachable via the internet to accommodate staff workflows, the potential for unauthorized access increases significantly.

How should I respond if my organization uses SLiMS?

Begin by identifying all running instances of SLiMS Bulian 9.8.0 within your environment. Once mapped, assess the network reachability and business criticality of each instance. Coordinate with your application or infrastructure teams to assign ownership and begin planning for security updates or mitigating controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.