CVE-2022-43362
About
Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
Rainforest analyst review
SLiMS (Senayan Library Management System) 9.4.2 carries a SQL injection in the collType parameter of loan_by_class.php. With the required privileged access, an attacker can bend that query to extract or modify the library database. The high-privilege metric means it is not an anonymous shot from the internet, it takes an account that can reach the vulnerable page.
SLiMS is widely used by libraries but in a diffuse, self-hosted way rather than as a single juicy internet target, and the authentication requirement keeps it out of pure mass-scan territory. The practical risk is an authenticated user, or a stolen library-staff credential, escalating read access into full database access. Impactful for the institution, but not the stuff of indiscriminate botnet campaigns.
We would size this against who holds accounts on the instance and whether it faces the public internet. Because it is a specific parameter on a specific script, it is a clean target for a virtual-patch rule while the upgrade is arranged, and we would pair that with a check that the SLiMS database credential is scoped tightly so a successful injection can't reach beyond that one application's data.
References
Related CVEs
Frequently asked questions
What is CVE-2022-43362?
Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
How severe is CVE-2022-43362?
CVE-2022-43362 carries a CVSS 3.1 base score of 7.2, rated high. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 76 out of 100, in the high band.
How is CVE-2022-43362 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required High, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2022-43362?
Public advisories list the following as affected: senayan library management system. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-43362?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.