High Severity
CVE-2026-107083
Published: Oct 27, 2026
SQL Injection via unquoted numeric concatenation in SLiMS 9.8.0 admin modules (subscription.php & dl_detail.php). CVE-2026-107083.
# CVE-2026-107083 — SQL Injection via Unquoted Numeric Concatenation in SLiMS 9.8.0 Admin Modules
## Summary
SLiMS 9.8.0 allows an authenticated staff user to perform **SQL Injection** in two admin modules where `$_GET` / `$_POST` values are concatenated into SQL without quoting or integer casting. The only sanitation applied is `$dbs->escape_string()`, which is ineffective for quote-free payloads in an unquoted numeric context.
**Impact:** Any authenticated staff account (any role) can perform error-based / UNION-based data extraction from the admin panel.
### Affected Components & Root Causes
1. **`admin/modules/serial_control/subscription.php` (line 128)**: `$_POST['itemID'][0]` is used raw in `WHERE serial_id=...`. When `itemID` is sent as an array, the `(integer)` cast is skipped, allowing direct SQL injection.
2. **`admin/modules/reporting/customs/dl_detail.php` (lines 62, 133)**: `$_GET['fileID']` is concatenated raw into `$criteria = 'fr.file_id =' . $_IDFile;`.
| Field | Value |
|-------|-------|
| CVE ID | CVE-2026-107083 |
| Official Record | [cve.org/CVERecord?id=CVE-2026-107083](https://www.cve.org/CVERecord?id=CVE-2026-107083) |
| Affected Version | SLiMS 9.8.0 (master) |
| Vulnerability Type | CWE-89: SQL Injection |
| Attack Vector | Network |
| Privileges Required | Low (any authenticated staff) |
| Affected Component | `admin/modules/serial_control/subscription.php` (`itemID`), `admin/modules/reporting/customs/dl_detail.php` (`fileID`) |
| Original Report | [slims/slims9_bulian#393](https://github.com/slims/slims9_bulian/issues/393) |
---
## Affected Files
| File | Vulnerable Lines |
|------|------------------|
| `admin/modules/serial_control/subscription.php` | 122–128 |
| `admin/modules/r