TI-2023-03497 Aliases CVE-2023-3744 GHSA-hjvr-v7mw-6f2j

Server-Side Request Forgery in SLiMS

MEDIUM 44CWE-918Published 2023-10-02 · Updated 2024-09-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00555 46th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SLIMS	SLiMS	9.6.0	—	No fix listed	CNA

SLiMS VendorSLIMS Affected 9.6.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:slims:senayan_library_management_system:9.6.0:::::::*	9.6.0	Vulnerable	SLIMS

cpe:2.3:a:slims:senayan_library_management_system:9.6.0:*:*:*:*:*:*:* Versions 9.6.0 Vulnerable ·SLIMS

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-3744
2026-10-03 Alias added: GHSA-hjvr-v7mw-6f2j

References

Advisory 1

https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims

TI-2023-24679 SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian… CVSS 3.1HIGH 8.8
TI-2023-21634 Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection… CVSS 3.1HIGH 8.8
TI-2023-14045 SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from… CVSS 3.1HIGH 7.5
TI-2022-22127 SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter. CVSS 3.1HIGH 7.5
TI-2025-19263 SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the… CVSS 3.1HIGH 7.2
TI-2022-21172 Senayan Library Management System v9.4.2 was discovered to contain a SQL injection… CVSS 3.1HIGH 7.2

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences