CVE-2018-25389

Vulnerability

HaPe PKH version 1.1 contains an SQL injection vulnerability in the lap-anggota-kelompok-pdf.php script. The nama_kelompok POST parameter is not sanitized, allowing an attacker to inject arbitrary SQL commands [1][3]. The code path is reachable without authentication. The same vulnerability also affects the desa parameter in lap-peserta-perdesa-pdf.php and the id parameter in several admin/media.php endpoints [1].

Exploitation

An unauthenticated attacker can send a crafted HTTP POST request to lap-anggota-kelompok-pdf.php with a malicious nama_kelompok parameter that includes a SLEEP() function for time-based blind SQL injection [1][3]. No special network position or user interaction is required beyond sending the request. The attacker can infer database information by observing response delays.

Impact

Successful exploitation allows the attacker to infer and extract sensitive data from the underlying database, including user credentials, session tokens, and other application data [3]. The attacker gains read access to the entire database; the CVSS v3 base score is 8.2 (High) [1][3].

Mitigation

No official patch was published as of the release date of this advisory; the vendor's project page on SourceForge does not indicate a fixed version [2]. The application may be end-of-life or unmaintained. Sites running HaPe PKH 1.1 should remove the application from public access and migrate to an alternative solution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.