CVE-2017-12585: Slims Akasia

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.

Affected products

• Slims Akasia: version 8.0 only; version 8.1 only; version 8.2 only; version 8.3 only; version 8.3.1 only

Published 2017-08-06. Last modified 2026-06-17.