High severity8.2NVD Advisory· Published May 29, 2026· Updated May 29, 2026

CVE-2018-25389

Description

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Patches

Vulnerability mechanics

References

www.sitejo.idnvd
sourceforge.net/projects/hape-pkh/files/latest/downloadnvd
www.exploit-db.com/exploits/45588nvd
www.vulncheck.com/advisories/hape-pkh-sql-injection-via-nama-kelompok-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000