SLiMS Bulian CVE-2026-107083

Exploitation targets the SLiMS reporting feature by supplying a malicious value in the 'fileID' parameter to admin/modules/reporting/customs/dl_detail.php; the download-detail reporting function must be reachable. Because this file lives under the '/admin/' module tree, exploitation most likely requires an authenticated administrative/librarian session or that the admin interface is exposed without proper access control - the supplied PR:N vector conflicts with this and should be confirmed against the source. Limiting factors: the admin panel is typically restricted to staff and should not be internet-facing, so risk is highest where the admin interface is exposed, default/weak staff credentials are in use, or an attacker already holds a low-privilege staff account. Confirmed affected build is SLiMS Bulian (slims9_bulian) 9.8.0.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, implying remote unauthenticated SQL injection with full confidentiality, integrity, and availability impact. However, there is a significant conflict in the data: the vulnerable endpoint is 'admin/modules/reporting/customs/dl_detail.php', which resides inside SLiMS's authenticated administrative module and normally requires a logged-in staff/librarian session - this contradicts the PR:N (no privileges) in the supplied vector. This likely makes real-world exploitation authenticated rather than fully anonymous, which would lower the effective severity. No EPSS score, KEV listing, or SSVC decision data was provided, so automatability and widespread-exploitation signals cannot be assessed. A public GitHub repository dedicated to this CVE (github.com/Primandito/CVE-2026-107083) and a vendor issue thread (issue #393) indicate public exploit/PoC material likely exists, raising practical risk for exposed, internet-facing instances. Net: treat as a real but conditional priority - classic in-admin SQLi that is serious wherever the admin panel is reachable or where attacker-controlled librarian accounts exist, but the PR:N claim should be verified against the actual code path before trusting the unauthenticated 9.8 rating.

An attacker with (or who obtains) access to the SLiMS admin reporting module submits a crafted 'fileID' parameter to dl_detail.php, injecting SQL that is concatenated directly into a database query. Public exploit material appears to exist in a dedicated GitHub repository, lowering the skill barrier. The injection allows dumping credentials and library/patron data, modifying records, or potentially escalating to further compromise of the underlying database.