CVE-2018-25385

Vulnerability

E-Registrasi Pencak Silat versions up to and including 18.10 contain an SQL injection vulnerability in the monitor_nilai.php script. The id_partai GET parameter is not sanitized before being used in a SQL query, allowing an attacker to inject arbitrary SQL commands. The software is distributed via SourceForge as Pencak Silat Digital Scoring [1][2].

Exploitation

An unauthenticated attacker can send a crafted HTTP GET request to monitor_nilai.php with a malicious SQL payload in the id_partai parameter. The publicly available proof-of-concept [3] uses a UNION-based blind injection technique to extract data. No authentication or special network position is required; the attacker only needs to reach the web application.

Impact

Successful exploitation enables an attacker to execute arbitrary SQL queries, leading to disclosure of sensitive database contents. Specifically, the attacker can extract admin credentials (username and password hashes) and other user data from the database [4]. The confidentiality of the database is fully compromised, and additional attacks (e.g., privilege escalation or data manipulation) may become possible depending on the database privileges.

Mitigation

As of the available references, no official patch has been released. Users of E-Registrasi Pencak Silat 18.10 should consider the application vulnerable and take steps to isolate or replace it. A workaround would involve disabling the monitor_nilai.php endpoint or applying input validation via a web application firewall (WAF). The vendor project on SourceForge has not issued a fixed version [1][2].