SLiMS 9 Bulian EUVD-2026-104518

Exploitation requires a valid authenticated SLiMS staff/librarian account with access to the bibliography administration module (admin/modules/bibliography/index.php); this is the primary limiting factor (PR:L) and means the flaw is not remotely exploitable by anonymous users. The concrete trigger is supplying SQL metacharacters in the opac_hide or promoted GET parameters, which are concatenated into an unquoted numeric SQL context where escape_string() provides no protection. No special non-default configuration or user interaction is needed beyond holding staff credentials; the affected version is SLiMS 9 Bulian 9.8.0.

This is a genuine but second-tier priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation, but PR:L is the decisive moderator: an attacker must already hold an authenticated staff account in the SLiMS backend, which is not an anonymous internet-wide attack surface. The supplied 8.8 score is inflated by I:H and A:H, yet the description characterizes the flaw as error-based information disclosure and arbitrary data extraction - a read-oriented SELECT-context injection - so confidentiality (C:H) is the real impact while integrity/availability impact is not substantiated by the text. SSVC aligns with 'poc' exploitation, Automatable:no, and Technical Impact:total, which is consistent with a credentialed, non-wormable data-theft bug. EPSS reinforces this: 0.20% (10th percentile) indicates very low predicted exploitation volume, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. The signals are internally consistent (POC exists, low EPSS, no KEV, authentication required) and point to a real-but-targeted risk rather than a mass-exploitation emergency. Note the CPE 'cpe:2.3:a:n/a:n/a:*' and EUVD affected version 'n/a n/a' are null placeholders - affected scope is confirmed only by the product/version in the description (SLiMS 9 Bulian 9.8.0), not by structured metadata.

An authenticated staff user (or an attacker who has phished/reused staff credentials) sends a crafted GET request to admin/modules/bibliography/index.php with a malicious payload in the opac_hide or promoted parameter. Because escape_string() does not protect an unquoted numeric SQL context, the attacker injects an error-based SQL payload to extract usernames, password hashes, and other database contents. A public proof-of-concept exists (github.com/Primandito/CVE-2026-107082), lowering the skill required, though exploitation still demands valid staff authentication.