CVE-2018-25386

Vulnerability

HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php. The id parameter is not sanitized, allowing SQL code injection. Unauthenticated attackers can exploit the desa module (module=desa&act=hapus), while authenticated users can exploit pengurus, fasilitas, and kelompok modules (e.g., act=print, act=editpengurus, act=editfasilitas, act=editkelompok) [1][3].

Exploitation

An attacker sends HTTP GET requests to admin/media.php with malicious SQL in the id parameter. For unauthenticated exploitation, the desa module with act=hapus is used. For authenticated users, modules like pengurus with act=print or act=editpengurus are targeted. Proof-of-concept payloads are publicly available [1]. No authentication is required for the desa module; for other modules, the attacker must be logged in.

Impact

Successful SQL injection allows extraction of sensitive database information, including the current database user, database name, and DBMS version [1][3]. This information could be leveraged for further attacks if credentials are exposed.

Mitigation

No official patch has been released; the vendor appears inactive [2]. As a workaround, administrators should sanitize all user input to the id parameter and restrict access to admin/media.php. The software may be end-of-life. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.