CVE-2023-45996
📋 TL;DR
This SQL injection vulnerability in Senayan Library Management Systems allows remote attackers to execute arbitrary SQL commands via the reborrowLimit parameter in member_type.php. Attackers can extract sensitive database information, modify data, or potentially execute arbitrary code on the server. Organizations running vulnerable versions of SLiMS are affected.
💻 Affected Systems
- Senayan Library Management System (SLiMS)
📦 What is this software?
Senayan Library Management System by Slims
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, and potential remote code execution on the server.
Likely Case
Unauthorized access to sensitive library patron data, member information, and system configuration details.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public proof-of-concept exists showing SQL injection via reborrowLimit parameter. Exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check SLiMS repository for latest patched version
Vendor Advisory: https://github.com/slims/slims9_bulian/issues/216
Restart Required: No
Instructions:
1. Update to latest SLiMS version from official repository. 2. Apply input validation fixes for reborrowLimit parameter. 3. Test functionality after update.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize reborrowLimit parameter input
Modify member_type.php to validate reborrowLimit as integer using filter_var($reborrowLimit, FILTER_VALIDATE_INT)
Web Application Firewall Rule
allBlock SQL injection attempts targeting reborrowLimit parameter
Add WAF rule: deny requests containing SQL keywords in reborrowLimit parameter
🧯 If You Can't Patch
- Implement strict input validation for all user-supplied parameters
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Test if reborrowLimit parameter accepts SQL injection payloads in member_type.php endpointCheck Version:
Check SLiMS version in system configuration or admin panelVerify Fix Applied:
Verify reborrowLimit parameter now properly validates input as integer and rejects SQL payloads📡 Detection & Monitoring
Log Indicators:
- SQL error messages in application logs
- Unusual database queries from web application
- Multiple failed login attempts following SQL errors
Network Indicators:
- HTTP requests containing SQL keywords in reborrowLimit parameter
- Unusual outbound database connections
SIEM Query:
web_requests WHERE url CONTAINS 'member_type.php' AND parameters CONTAINS ANY('UNION', 'SELECT', 'INSERT', 'DELETE', 'UPDATE', 'OR', 'AND')