SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitorreportday.php component.