Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.
# The bug
A Server Side Request Forgery exists in `admin/modules/bibliography/pop_p2p.php` at the code below

```php
$detail_uri = $_GET['uri'] . "/index.php?p=show_detail&inXML=true&id=" . $_GET['biblioID'];
// parse XML
$data = modsXMLsenayan($detail_uri, 'uri');
```

# To Reproduce

**Steps to reproduce the behavior:**
1. Login as admin or user that has access to bibliography
2. set up netcat to listen to a specific port (example: 7878)
3.  go to the `/admin/modules/bibliography/pop_p2p.php?uri=http://LOCALHOST_OR_LISTENER_IP:7878`
4. the netcat should receive a request 

# Screenshots

### proof-of-concept using pipedream

<img width="1439" alt="image-ssrf-2" src="https://github.com/slims/slims9_bulian/assets/116742485/016f1312-e5ed-4449-b882-280bef3a86b6">



### proof-of-concept using netcat

<img width="1438" alt="image-ssrf-1" src="https://github.com/slims/slims9_bulian/assets/116742485/b3103157-580d-4960-9e2c-3f484b203f83">


# versions

- Browser: Google Chrome | 115.0.5790.114 (Official Build) (x86_64)
Slims Version: slims9_bulian-9.6.1

[Security Bugs]  Server Side Request Forgery at pop_p2p.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bugs]  Server Side Request Forgery at pop_p2p.php
Issue date:

--- start body ---
# The bug
A Server Side Request Forgery exists in `admin/modules/bibliography/pop_p2p.php` at the code below

```php
$detail_uri = $_GET['uri'] . "/index.php?p=show_detail&inXML=true&id=" . $_GET['biblioID'];
// parse XML
$data = modsXMLsenayan($detail_uri, 'uri');
```

# To Reproduce

**Steps to reproduce the behavior:**
1. Login as admin or user that has access to bibliography
2. set up netcat to listen to a specific port (example: 7878)
3.  go to the `/admin/modules/bibliography/pop_p2p.php?uri=http://LOCALHOST_OR_LISTENER_IP:7878`
4. the netcat should receive a request 

# Screenshots

### proof-of-concept using pipedream

<img width="1439" alt="image-ssrf-2" src="https://github.com/slims/slims9_bulian/assets/116742485/016f1312-e5ed-4449-b882-280bef3a86b6">



### proof-of-concept using netcat

<img width="1438" alt="image-ssrf-1" src="https://github.com/slims/slims9_bulian/assets/116742485/b3103157-580d-4960-9e2c-3f484b203f83">


# versions

- Browser: Google Chrome | 115.0.5790.114 (Official Build) (x86_64)
Slims Version: slims9_bulian-9.6.1

--- end body ---
