CVE-2022-50805: Senayan Library System SQLi Vulnerability

CVE-2022-50805 Overview

CVE-2022-50805 is a SQL injection vulnerability affecting Senayan Library Management System (SLIMS) version 9.0.0. The vulnerability exists in the class parameter, which fails to properly sanitize user input before incorporating it into database queries. This allows unauthenticated attackers to inject malicious SQL queries through crafted payloads, potentially leading to unauthorized data extraction and manipulation of the underlying database.

Critical Impact

Attackers can exploit this SQL injection flaw to bypass authentication, extract sensitive library user data, and potentially gain unauthorized access to the entire database contents.

Affected Products

• Senayan Library Management System (SLIMS) 9.0.0

Discovery Timeline

• 2026-01-13 - CVE-2022-50805 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50805

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper neutralization of special elements used in SQL commands within the SLIMS application. The class parameter accepts user-supplied input that is directly concatenated into SQL queries without adequate validation or parameterization. This classic injection pattern allows attackers to break out of the intended query context and execute arbitrary SQL statements against the database backend.

The network-accessible nature of this vulnerability means that any attacker with HTTP access to the SLIMS installation can attempt exploitation without requiring prior authentication. Successful exploitation enables attackers to read sensitive database contents, including user credentials, patron information, and library records. Additionally, depending on database privileges, attackers may be able to modify or delete data.

Root Cause

The root cause is insufficient input validation and the use of dynamic SQL query construction. The application fails to implement parameterized queries or prepared statements when handling the class parameter, allowing attacker-controlled data to be interpreted as SQL code rather than data values. This represents a fundamental secure coding violation where user input is trusted and directly incorporated into database operations.

Attack Vector

The attack is conducted remotely over the network. An attacker submits specially crafted HTTP requests containing malicious SQL syntax within the class parameter. When the vulnerable application processes these requests, the injected SQL code executes with the privileges of the database user configured for the SLIMS application. This can be exploited using common SQL injection techniques such as UNION-based extraction, error-based extraction, or time-based blind injection to enumerate database structure and extract data.

Technical details and proof-of-concept information are available through the GitHub PoC Repository and Exploit-DB #51161.

Detection Methods for CVE-2022-50805

Indicators of Compromise

• Unusual database queries containing SQL keywords in the class parameter such as UNION, SELECT, OR 1=1, or encoded variants
• Web server logs showing requests with excessive special characters or SQL syntax in query parameters
• Database logs indicating query errors or unusual query patterns from the SLIMS application
• Unexpected database access patterns or large data exports from the library management tables

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in HTTP parameters
• Implement database activity monitoring to identify anomalous queries or bulk data access
• Configure application logging to capture all requests containing the class parameter for forensic analysis
• Use intrusion detection systems with signatures for SQL injection attack patterns

Monitoring Recommendations

• Monitor web server access logs for requests containing SQL keywords and special characters in URL parameters
• Enable database query logging and alert on queries with unusual syntax or execution times
• Track failed authentication attempts that may indicate automated exploitation attempts
• Review database user activity for evidence of privilege escalation or unauthorized data access

How to Mitigate CVE-2022-50805

Immediate Actions Required

• Upgrade Senayan Library Management System to the latest available version that addresses this vulnerability
• Implement network-level access controls to restrict SLIMS access to authorized users and networks only
• Deploy a Web Application Firewall with SQL injection protection rules in front of the SLIMS installation
• Review database logs for signs of prior exploitation and assess potential data exposure

Patch Information

Organizations running SLIMS 9.0.0 should consult the SLIMS Official Website for updated versions and security patches. Additionally, the VulnCheck Security Advisory provides further guidance on remediation steps.

Workarounds

• Implement input validation at the application level to reject requests containing SQL metacharacters in the class parameter
• Use parameterized queries or prepared statements if modifying the application code is possible
• Restrict database user privileges to minimum required permissions (principle of least privilege)
• Consider placing the SLIMS application behind a reverse proxy with SQL injection filtering capabilities

# Example: Apache mod_security rule to block SQL injection attempts
# Add to Apache configuration or mod_security rules file
SecRule ARGS:class "@detectSQLi" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt detected in class parameter'"