CVE Feed

    Dashboard / CVE / CVE-2017-12584

    CVE-2017-12584

    There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the passwd1 and passwd2 fields in an admin/modules/system/app_user.php changecurrent=true operation.

    Published:Aug 6, 2017
    Last Modified:Apr 20, 2025
    EPS:Aug 6, 2017
    EPSS Score:0.00239
    CVSS Score:8.8

    Affected Products

    Vendor
    Slims
    Product
    Senayan Library Management System

    Exploits

    https://github.com/slims/slims8_akasia/issues/49https://github.com/slims/slims8_akasia/issues/49

    Related CVEs

    CVE-2022-50805 (CVSS 8.8) — Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that a…
    CVE-2025-61488 (CVSS 7.6) — An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arb…
    CVE-2025-26200 (CVSS 7.2) — SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the …
    CVE-2024-25288 (CVSS 4.9) — SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabo…
    CVE-2023-45996 (CVSS 8.8) — SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote…
    CVE-2023-3744 (CVSS 9.9) — Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authentica…
    CVE-2023-40970 (CVSS 8.8) — Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/cir…
    CVE-2023-40969 (CVSS 6.1) — Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) v…
    CVE-2023-29850 (CVSS 7.5) — SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This al…
    CVE-2022-45019 (CVSS 7.5) — SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High