PT-2025-7773 · Slims · Slims

Broccolitos · Published 2025-02-24 · Updated 2025-05-01 · CVE-2025-26200

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SLIMS version 9.6.1

Description The issue allows a remote attacker to escalate privileges. This is achieved via the month parameter in the "visitor report day.php" component.

Recommendations For SLIMS version 9.6.1, consider restricting access to the visitor report day.php component until a patch is available. As a temporary workaround, avoid using the month parameter in the affected component to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-26200

Affected Products

Slims

References · 7

• 🔥 https://mebroccoli.blogspot.com/2025/02/cve2.html · Exploit
• https://github.com/slims/slims9_bulian/issues/269 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-26200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26200 · Security Note
• https://twitter.com/CVEnew/status/1894066286281593201 · Twitter Post
• https://t.me/cvenotify/120535 · Telegram Post
• https://t.me/cvedetector/18818 · Telegram Post