# primandito/cve-2026-107081 architecture

> Architecture diagram of the GitHub repository primandito/cve-2026-107081, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/primandito/cve-2026-107081
- Repository: https://github.com/primandito/cve-2026-107081

## Overview

This repository is a security write-up documenting SQL identifier injection in three SLiMS admin AJAX endpoints, rather than the SLiMS application itself. The documented workflow is an authenticated staff member submitting endpoint parameters that are interpolated into SQL, allowing database information to be disclosed. The README also identifies an admin-wide sanitizer configuration as a contributing factor. Only documented relationships are shown; no application source excerpts were provided, so implementation details beyond the write-up are not represented.

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_affected_endpoints["Affected endpoints"]
  node_lookup["Lookup AJAX"]
  node_check_id["Check ID AJAX"]
  node_vocabulary["Vocabulary AJAX"]
end

subgraph group_admin_context["Admin context"]
  node_sanitizer["Admin sanitizer"]
end

node_staff(("Authenticated staff"))
node_database[("MariaDB")]

node_staff -->|"submits parameters"| node_lookup
node_staff -->|"submits parameters"| node_check_id
node_staff -->|"submits parameters"| node_vocabulary
node_sanitizer -->|"leaves identifiers unfiltered"| node_lookup
node_sanitizer -->|"leaves identifiers unfiltered"| node_check_id
node_sanitizer -->|"leaves identifiers unfiltered"| node_vocabulary
node_lookup -->|"queries"| node_database
node_check_id -->|"queries"| node_database
node_vocabulary -->|"queries"| node_database

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_lookup,node_check_id,node_vocabulary toneBlue
class node_sanitizer,node_database toneAmber
class node_staff toneIndigo
```

## Components

### Affected endpoints

- **Lookup AJAX**
- **Check ID AJAX**
- **Vocabulary AJAX**

### Admin context

- **Admin sanitizer**

### Other components

- **Authenticated staff**
- **MariaDB**

## Connections

- Authenticated staff → Lookup AJAX: submits parameters (evidence: `README.md`)
- Authenticated staff → Check ID AJAX: submits parameters (evidence: `README.md`)
- Authenticated staff → Vocabulary AJAX: submits parameters (evidence: `README.md`)
- Admin sanitizer → Lookup AJAX: leaves identifiers unfiltered (evidence: `README.md`)
- Admin sanitizer → Check ID AJAX: leaves identifiers unfiltered (evidence: `README.md`)
- Admin sanitizer → Vocabulary AJAX: leaves identifiers unfiltered (evidence: `README.md`)
- Lookup AJAX → MariaDB: queries (evidence: `README.md`)
- Check ID AJAX → MariaDB: queries (evidence: `README.md`)
- Vocabulary AJAX → MariaDB: queries (evidence: `README.md`)